Ignore Delegation Failure
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2003
Path in the GPO console
Computer Configuration\Administrative Templates\System\Remote Procedure Call Description
This policy setting controls whether the RPC Runtime ignores delegation failures when delegation is requested. The constrained delegation model, introduced in Windows Server 2003, does not report that delegation was enabled on a security context when a client connects to a server. Callers of RPC and COM are encouraged to use the RPC_C_QOS_CAPABILITIES_IGNORE_DELEGATE_FAILURE flag, but some applications written for the traditional delegation model prior to Windows Server 2003 may not use this flag and will encounter RPC_S_SEC_PKG_ERROR when connecting to a server that uses constrained delegation. If you disable this policy setting, the RPC Runtime will generate RPC_S_SEC_PKG_ERROR errors to applications that ask for delegation and connect to servers using constrained delegation. If you do not configure this policy setting, it remains disabled and will generate RPC_S_SEC_PKG_ERROR errors to applications that ask for delegation and connect to servers using constrained delegation. If you enable this policy setting, then: -- "Off" directs the RPC Runtime to generate RPC_S_SEC_PKG_ERROR if the client asks for delegation, but the created security context does not support delegation. -- "On" directs the RPC Runtime to accept security contexts that do not support delegation even if delegation was asked for. Note: This policy setting will not be applied until the system is rebooted.
Registry
Software\Policies\Microsoft\Windows NT\Rpc MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_RPC/RpcIgnoreDelegationFailure Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Ignore Delegation Failure
; State: Enabled
; Supported on: At least Windows Server 2003
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc]
"IgnoreDelegationFailure"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Ignore Delegation Failure
# State: Enabled
# Supported on: At least Windows Server 2003
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Rpc'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'IgnoreDelegationFailure' -Value 0 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_RPC/RpcIgnoreDelegationFailure
Data type: String
Value:
<enabled/>
<data id="RpcIgnoreDelegationFailureList" value="0"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Ignore Delegation Failure
# State: Enabled
# Supported on: At least Windows Server 2003
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Rpc' -Name 'IgnoreDelegationFailure' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Ignore Delegation Failure
# State: Enabled
# Supported on: At least Windows Server 2003
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Rpc'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'IgnoreDelegationFailure' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Ignore Delegation Failure
# State: Enabled
# Supported on: At least Windows Server 2003
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Ignore Delegation Failure
# State: Enabled
# Supported on: At least Windows Server 2003
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Rpc' -Name 'IgnoreDelegationFailure' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Ignore Delegation Failure
# State: Enabled
# Supported on: At least Windows Server 2003
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Rpc'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'IgnoreDelegationFailure' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.