Enable Delegated Managed Service Account logons

Policy ID: DelegatedMSAEnabled
Scope: Computer Configuration
Supported on: At least Windows 11 Version 24H2
Source: Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
Category: System › Kerberos

Description

This policy setting enables or disables delegated managed service account logons for this machine.

If you enable this policy setting, delegated managed service account logons will be supported by the Kerberos client. Note that this policy has certain prerequites. The prerequisites and the directions to create a new delegated managed service account can be found at https://go.microsoft.com/fwlink/?linkid=2250379.

If you disable or do not configure this policy setting, delegated managed service account logons will not be supported.

Options

Realms:
Syntax:
Enter a list of realms where DMSAs might exist.
Enter both the Fully Qualified Domain Name (FQDN) and the short name.
Enter one realm per line.
Details:
The Kerberos client will attempt to find a DMSA capable Domain Controller for the listed realms.
If no realms are specified, the Kerberos client will attempt to find a DMSA capable Domain Controller for all realms.

Registry

ComputerHKEY_LOCAL_MACHINE

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters View registry values

DelegatedMSAEnabledREG_DWORD
DmsaRealmsREG_MULTI_SZ

Other policies in the same category

View all policies in this category (17)