Your network contains two Active Directory Domain Services (AD DS) forests named contoso.

In the Administering Windows Server Hybrid Core Infrastructure guidance for Windows Admin Center (WAC) and Kerberos delegation, resource-based constrained delegation (RBCD) is configur ed on the resource’s computer account , not on the client/gateway. The documentation explains that “resource-based constrained delegation is applied to the target service account; the target’s msDS-AllowedToActOnBehalfOfOtherIdentity attribute contains the security principals (computers or service accounts) that are permitted to act on behalf of users.” It further clarifies that “this model supports cross-domain and cross-forest scenarios when a trust exists; you specify the front-end computer (for example, a WAC gateway) from the trusted forest as an allowed principal on the resource computer in its own domain.”

For WAC, the gateway (Server1 in contoso.com ) must be allowed to delegate to the managed node (Server2 in fabrikam.com ). The study materials show th e exact PowerShell interface: “Use Set-ADComputer with -PrincipalsAllowedToDelegateToAccount to populate the resource’s allowed-to-act list.” Therefore, the Identity parameter must reference the resource computer account (Server2 in fabrikam.com), and the PrincipalsAllowedToDelegateToAccount parameter must reference the gateway computer account (Server1 in contoso.com).

Hence the correct command is:

Set-ADComputer -Identity (Get-ADComputer server2.fabrikam.com) -PrincipalsAllowedToDelegateToAccount (Get-ADC omputer server1.contoso.com)