We want to use Windows Admin Center to manage our environment; WAC will run on a dedicated server in gateway mode, and administrators will manage servers through WAC.
This requires setting up Kerberos constrained delegation to allow WAC to operate on the servers on behalf of the users; this is well documented, and works this way:
$wac = Get-AdComputer "WAC Server Name"
$server = Get-AdComputer "Managed Server Name"
Set-ADComputer $server -PrincipalsAllowedToDelegateToAccount $wac
Of course, this can easily be scripted for multiple servers.
However, what we would like is for this to be automated: when a new server is joined to the domain, the WAC gateway should automatically be granted a Kerberos delegation to manage it.
Unfortunately, this doesn't seem to be an actual ACL on the computer object; thus it doesn't seem possible to handle this with an ACL at the OU or domain level. Also, there doesn't seem to be any GPO setting for this (or at least I couldn't find it).
How can we automatically enable Kerberos delegation to the WAC gateway for all computers when they are joined to the domain?
