Windows 10: How do I delegate applications to be the "best match" or come up first in the Start...

I always use the Start search-bar to open applications and find it to be very efficient.I often need to open Whatsapp Web on my Windows 10 laptop and simply typing the "w" key, then pressing enter would open the app as Windows would configure Whatsapp Web to be the "best match", hence opening it on pressing "Enter".Something like this, but instead of typing "wh", just typing "w" would show Whatsapp Web. Just typing "w" and pressing "Enter" worked for years.Recently I've been having this problem where whenever I type in "w" in the Start search-bar, it shows Microsoft Word to be the best match,

:)

 

Explorer.exe, Werfault.exe, RuntimeBroker.exe (application errors). start wont come up and application errors wont go

Hi James,



Thank you for your response with the current update on the issue.

To assist you to better, please provided us the information below:

• Have you tried to perform all the steps provided in the previous post?
• Have you created another user account as suggested in the step 2?

Please try to perform the step 1 and step 2 provided in the previous post. Let us know of the results after performing it.

Please get back to us with an update on issue with Start Menu and running application, we will be happy to help.



Thank you.

 

Kerberos delegation & Applications

Helllo all,

Here below is my understanding about Kerberos delegation :

1] Unrestricted delegation (W2000): Windows 2000 allows a authorized user to forward a TGT: he asks for a forwardable TGT (Authentication Service) and can then ask for a forwarded TGT (Ticket
Granting Service) he may .. forward along with the session key (shared with the KDC for this forwarded TGT) to a service (krb_cred message). The service may then request a ticket service on the user's behalf for any service and may in turn also forward the
TGTto any other service [proxiable/proxy tickets are out of scope since it seems not to be used due to the prerequisites it requires],

2] Restricted delegation (since W2003) : A IT admin can configure a service in the AD (SPN) to be authorized to request a ticket service on behalf of a user for a set of services (SPN) : "Allowed-To-Delegate-To"
(A2D2) parameter. Moreover, a new extensions (S4U2Proxy) allows a service to request a ticket service on the user's behalf for an other service since it is able to present a valid and forwardable ticket on the behalf of the user for itself (so, it means there
is no need anymore to get the TGT from the user and its associated session key). To get a forwardable ticket for itself, the service shall be tagged as "Trusted-To-Authenticate-For-Delegation" (T2A4D),

3] Protocol Transition (S4U2self) (since W2003) : A service may ask the KDC for a ticket service (for itself) on behalf of the user without showing any evidence to the KDC indicating the user
has been authenticated by Kerberos. This can be done by enabling the flag "Use any protocol" in the configuration of the SPN in the AD. Then, it could use constrained delegation if the proper flags (T2A4D and A2D2) are set for this service,

4] Constrained delegation cross domains (since W2012) :

¤ Where before it wasn't possible to use delegation cross domains (because not possible to set a SPN out ot the current domain of a SPN), authorization can now be configured on the target service instead of
the source service (conceptually, it's more logical).

¤ A specific SID ($$) may be configured on the target service to authorize or not a delegation when the user was not explictely authenticated by the KDC (it means when a service used its protocol transition
ability to get a ticket for itself) : in order for this to work, it means (I guess) that the ticket service granted to the source service for the target service contains this information.

What is not clear to me:

1) After reading MS articles, I understand that forwarded TGTs cannot be used to do constrained delegation although there is clearly a "forwarded" flag in the TGT. Indeed, this is quite different compared to
a service which uses its own TGT with a ticket service for itself, because with the user's TGT, the service is authenticated as the user which requests a service ticket. Is there any meaning in using the "address" field of a ticket request, which is intended
to contain the iP/DNS address of the requestor (this could be modifiable of course) ? Is there any parameter to refuse a ticket request when a forwarded TGT is used ? Why not use the adress field (client) to check the associated rights ? Is it because it's
not reliable (address may be spoofed) or because it's not precise enough to identify a SPN ?

2) Introducing the SID ($$) implies to me that the forwardable service ticket does contain a specific information saying this ticket was obtained through S42Uself extensions or was directly obtained by the
user. But I don't know what it is,

3) Forwarded TGTs seem to be "deprecated" if it means delegation cannot be constrained. So, I don't understand why there are one forwardable and one forwarded TGT (so for delegation) when I display my cached
tickets using klist (Windows 10 machine in a corporate environment, and this for two different compagnies). Is is a standard and recommended practice or do I miss something ?

Thanks a lot for your feedback !! Have a great day.

.

 

Active Directory - Delegate Control + RSAT

Hi,

I want to provide a delegate access to one of our employees to be able to just edit the group membership for a particular user. ( Done providing delegated access)

But, She cant get into the ADUC without being a domain administrator.

We are on windows server r2 2012. Tried installing RSAT Download Remote Server Administration Tools for Windows 8.1 from Official Microsoft Download Center. but gives an error" Update not supported for this machine:...

Any suggestions?

Thank you.