Enable computer and user accounts to be trusted for delegation

Hi Arnold,  Thanks for helping.  OK,  The only thing in event viewer was  "Security policy in the Group policy objects are applied successfully. "

when I try to run command   gpupdate /force  it tells me

C:\>gpupdate /force
'gpupdate' is not recognized as an internal or external command,
operable program or batch file.

I tried running secedit /gpupdate /force and it didn't do anything... no indication that anything happened...

What OS is your system running? GPupdate replaced the secedit /refreshpolicy in winXp and higher.

Computer configuration changes applied on refresh and when the system starts up.

You could have administrative rights on individual member server, but you might not be a member of the domains admin group.

Arnold,  like I mentioned,  it is a windows 2000 domain.  I have three DC's all running 2000 sp4.    I tried doing the trusting the user for delegation option in Active directory from two of the domain controllers logged in as the domain administrator.  I also tried this with my account which is a member of the domain admins.

Ok, so you are running windows 2000 SP4.
http://technet.microsoft.com/en-us/library/cc772723%28WS.10%29.aspx

http://www.windowsecurity.com/articles/Delegation_Authentication_Windows_Server_2003.html

What is the functional level of your AD Domain?
Properties of the Domain in the ADUC.
Is it windows 2000 Native or is it mixed?

The fact that you are running windows 2000 servers as DC does not necessarily make the functional level of the Domain/forest as win2k native.  You might need to elevate the functional level to 2000 native.  The restriction is that there must not be any NT 4. PDC/BDC

OK, in ADUC is says...   Domain operation mode :  Native mode (no pre-windows 2000 domain controllers)  Yes,  no NT4 PDC/BDC

So,  if it says it is already in native mode.  do I need to rerun a tool to reset this functionality fo the domain?  

Could you double check that the GPO to which you added the delegation rights actually propagated and is not in an error state?  IS this the default domain GPO?
http://www.experts-exchange.com/Security/Operating_Systems_Security/Windows/Q_20898667.html

http://mailman.mit.edu/pipermail/kerberos/2007-October/012448.html

Arnold,  Yes, it is the default GPO  and yes it is propagating.  I checked on another DC after I set the delegation rights and it showed up on that DC so I know it appears to be propagating....  

we have another GPO for the windows update servise and I set the delegation rights on that as well,  just to be safe...

still not allowing me to set trust delegation on user account.

I know...  I'm scratching my head too.  it should be working..

Do you have support tools/resource kit/admin pak installed.
Try running gpotool to make sure that all the DC's have the same version of the Policy.
If you have an XP workstation in the mix, you could install the windows 2003 support tools, resource kit and admin pak as well as GPMC from http://www.microsoft.com/downloads/details.aspx?familyid=0a6d4c24-8cbd-4b35-9272-dd3cbfc81887&displaylang=en  if you do not have it already. And double check that something else is not preventing the policy changes from propagating or applying.

Hello arnold.  I ran the GPO tool.  not sure what to make of it......  do you see anything that might ppoint to my problem with the truct delegation?

------------------------------------------------------------
============================================================
Policy {2F3E2E55-00FC-481B-B07E-CD2C37CE6952}
Policy OK
============================================================
Policy {31B2F340-016D-11D2-945F-00C04FB984F9}
Policy OK
============================================================
Policy {669484CB-E5DC-4817-8135-9A0E076B1C5F}
Policy OK
============================================================
Policy {6AC1786C-016F-11D2-945F-00C04FB984F9}
Policy OK
============================================================
Policy {9BC2D082-E55D-4929-8AB9-7BF487754197}
Policy OK
============================================================
Policy {B66E9775-9521-469F-B273-2BA3B5BFBD6D}
Policy OK
============================================================
Policy {C8FB3A04-655E-444D-A888-79ECADF34DEB}
Policy OK
============================================================
Policy {CBFB10C0-88CB-4395-88D3-C6A620E361F4}
Policy OK
============================================================
Policy {D8040301-E42B-49BD-BB60-268B682D9C12}
Error: Cannot access \\col**.domain.en*ony.com\sysvol\domain.en*ony.com\policies\{D8040301-E42B-49BD-BB60-268B682D9C12}, error 2
Error: Cannot access \\corpserv01.domain.en*ony.com\sysvol\domain.en*ony.com\policies\{D8040301-E42B-49BD-BB60-268B682D9C12}, error 2
Error: Cannot access \\corpserv04.domain.en*ony.com\sysvol\domain.en*.com\policies\{D8040301-E42B-49BD-BB60-268B682D9C12}, error 2
Details:
------------------------------------------------------------
DC: col**.domain.en**ony.com
Friendly name: New Group Policy Object
Created: 8/8/2005 9:35:27 PM
Changed: 8/8/2005 9:41:17 PM
DS version:     0(user) 0(machine)
Sysvol version: not found
Flags: 0
User extensions: not found
Machine extensions: not found
Functionality version: 2
------------------------------------------------------------
------------------------------------------------------------
DC: corpserv01.domain.en*ony.com
Friendly name: New Group Policy Object
Created: 8/8/2005 9:35:27 PM
Changed: 8/8/2005 9:40:57 PM
DS version:     0(user) 0(machine)
Sysvol version: not found
Flags: 0
User extensions: not found
Machine extensions: not found
Functionality version: 2
------------------------------------------------------------
------------------------------------------------------------
DC: corpserv04.domain.en*ony.com
Friendly name: New Group Policy Object
Created: 8/8/2005 9:35:27 PM
Changed: 8/8/2005 9:41:17 PM
DS version:     0(user) 0(machine)
Sysvol version: not found
Flags: 0
User extensions: not found
Machine extensions: not found
Functionality version: 2
------------------------------------------------------------
============================================================
Policy {F8C4A75A-C954-4036-8ED9-DFCD5447F256}
Policy OK

Errors found

Thanks Arnold,  OK,  got the GPMC installed.  when I ran it it showed the two GPOs that I have.  however,  I did see under group policy object in the tree dtructure on the left panel,  a number of policies...  some were labeled test policy 1,2 ect...  some were called new group policy...  The creation dates and modify dates were old (2004,2005)  I backed them up and then deleted them from the group policy manager.  
The others listed....
*Default domain controllers policy
*default domain policy
*IT
*symantec update
*windows update
 I opened them up and edited the security setting by opening the appropriate policy and expanding the console tree : Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\
I opened enabled computer and users accounts to be trusted policy and added administrator and domain admin to the each policy.  I then ran the following line in the command.  
secedit /refreshpolicy machine_policy /enforce

logged out and back in and checked if I could tick the checkbox trusting the user for delegation, hit 'Apply'
Good news.. No error message!  it looks like one of those old policies were the problem....  how come those policies didn't show up in the gpo editor in active directory users and groups?   but show up in the group policy managment console?

GPMC was created to centralize the management of all GPOs on the Domain.
I think the pre GPMC, you had to be on the right OU to see the GPOs that were explicitly applied to it.
Not sure whether the inheritance mechanism was such that one policy would prevent the application of another.
It is hard to say.  Looking at the system/application log on the computer when the refersh of the secedit was done, could show errors with some policies possibly preventing the settings or resetting the settings set by higher level domain policies.

Glad to hear all is fixed.