Skip to main content
Version: 2.1.1-preview

Test-MtAdComputerNonDcConstrainedDelegationCount

SYNOPSIS​

Counts non-domain controller computers with constrained delegation configured.

SYNTAX​

Test-MtAdComputerNonDcConstrainedDelegationCount [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

Constrained delegation (also known as "protocol transition" or "S4U2Proxy") allows a service to impersonate a user to specific services only. While safer than unconstrained delegation, it should still be carefully reviewed and minimized. This test identifies non-DC computers with constrained delegation enabled.

Security Considerations:

  • Constrained delegation is safer than unconstrained but still carries risk
  • Should be limited to specific required scenarios (e.g., web applications)
  • Each computer with constrained delegation should be reviewed
  • Consider using resource-based constrained delegation as a more secure alternative

EXAMPLES​

EXAMPLE 1​

Test-MtAdComputerNonDcConstrainedDelegationCount

Returns $true if computer data is accessible.

PARAMETERS​

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtAdComputerNonDcConstrainedDelegationCount