Computer delegation count should be retrievable
AD-COMP-09InfoActive DirectoryComputers
Part of Active Directory · Active Directory · Computers · All checks
Invoke-Maester -TestId AD-COMP-09Overview
Section titled “Overview”Kerberos delegation allows a service to impersonate users when accessing other resources. While necessary for some applications, delegation—especially unconstrained delegation—creates significant security risks:
- Unconstrained delegation: The service can impersonate users to ANY service on ANY system (highest risk)
- Constrained delegation: Limited to specific services, but still requires careful management
- Protocol transition: Allows S4U2Self/S4U2Proxy operations that can be exploited
- Lateral movement: Attackers can abuse delegation for privilege escalation and lateral movement
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Minimize unconstrained delegation: Use it only when absolutely necessary, and never on tier 0 systems
- Prefer constrained delegation: Limit services to only those they need to access
- Use resource-based constrained delegation: More secure alternative in modern environments
- Regular audits: Periodically review which computers have delegation enabled
- Remove unused delegation: Disable delegation on systems that no longer require it
- Consider Group Managed Service Accounts (gMSA): These provide better security for service accounts
How the Test Works
Section titled “How the Test Works”This test counts computers with different delegation configurations:
TrustedForDelegation(unconstrained delegation)TrustedToAuthForDelegation(constrained delegation with protocol transition)
Related Tests
Section titled “Related Tests”Test-MtAdComputerDelegationDetails- Provides detailed breakdown of delegation per computerTest-MtAdComputerDormantCount- Identifies stale accounts that may have delegation enabled
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-COMP-09 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Computers |
| Area | Authentication |
| Resource type | Computer |
| MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket |
| PowerShell test | Test-MtAdComputerDelegationCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/computer/Test.AD-COMP-09.ps1 - Documentation:
tests/ad/computer/Test.AD-COMP-09.md