Skip to main content
Version: 2.3.0

Test-MtAdComputerNonDcUnconstrainedDelegationCount

SYNOPSIS​

Counts non-domain controller computers with unconstrained delegation.

SYNTAX​

Test-MtAdComputerNonDcUnconstrainedDelegationCount [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

Non-DC computers with unconstrained delegation represent a significant security risk. While domain controllers may require unconstrained delegation for certain scenarios, regular computers should never have this configuration. This test specifically identifies non-DC computers with unconstrained delegation enabled.

Security Risk:

  • Non-DC computers with unconstrained delegation are a critical vulnerability
  • Compromise of such a computer allows attackers to impersonate any domain user
  • This configuration should be eliminated in favor of constrained delegation
  • Zero non-DC computers should have unconstrained delegation

EXAMPLES​

EXAMPLE 1​

Test-MtAdComputerNonDcUnconstrainedDelegationCount

Returns $true if no non-DC computers have unconstrained delegation (or if data is accessible).

PARAMETERS​

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtAdComputerNonDcUnconstrainedDelegationCount