Hello,
we are in the process of implementing a more secure administration model.
One key feature we want to use is the protected users group.
Issue: create Namespace fails when using DFS GUI
If we use DFSutil or PowerShell everything works as expected.
However, when using the DFS Management GUI it does not work when working on a member server.
Error Message is: The namespace cannot be queried. access denied
In the event logs you can see a NTLM logon event that gets denied because the user is a member of the protected users group.
It does work when creating the Namespace on a domain controller.
Consequently if you remove the user form this group everything works as expected on the member server.
So the question is: how to enable kerberos authentication for the DFS management GUI
Forest and Domain level Windows 2012R2, all severs Windows 2012R2
Anyone has some experience regarding this issue?