Computers with unconstrained delegation count should be investigated
AD-DCOMP-01InfoActive DirectoryComputers
Part of Active Directory · Active Directory · Computers · All checks
Invoke-Maester -TestId AD-DCOMP-01Overview
Section titled “Overview”- Unconstrained delegation is one of the most dangerous configurations in Active Directory. When enabled on a computer, it allows services on that computer to impersonate authenticated users to ANY service on ANY computer in the domain.
Security Risks:
- Complete Impersonation: Attackers can impersonate any user who authenticates to the computer
- Lateral Movement: Compromising one computer with unconstrained delegation enables access to all domain resources
- Privilege Escalation: Can be used to escalate from standard user to domain admin
- Ticket Theft: Attackers can harvest TGTs from memory on these computers
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”-
Eliminate unconstrained delegation:
- Replace with constrained delegation or resource-based constrained delegation
- Audit all computers with this setting
- Prioritize non-DC computers for remediation
-
Protect computers that require delegation:
- Limit to absolute minimum necessary
- Place in isolated OU with strict access controls
- Monitor for compromise indicators
-
Use alternatives:
- Constrained Delegation: Limits impersonation to specific services
- Resource-Based Constrained Delegation: More flexible and secure approach
- Protocol Transition: When combined with constrained delegation
How the Test Works
Section titled “How the Test Works”This test counts computers with the TrustedForDelegation flag enabled and categorizes them by:
- Domain Controllers vs. non-DC computers
- Total count and percentage
Related Tests
Section titled “Related Tests”Test-MtAdComputerNonDcUnconstrainedDelegationCount- Focuses on non-DC computers (critical risk)Test-MtAdComputerNonDcConstrainedDelegationCount- Reviews constrained delegationTest-MtAdUserDelegationConfiguredCount- Reviews user account delegation
Related links
Section titled “Related links”- Microsoft Defender for Identity: Unsecure Kerberos delegation
- ANSSI Active Directory checkpoints: Unconstrained authentication delegation
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DCOMP-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Computers |
| Area | Authentication |
| Resource type | Computer |
| MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket |
| PowerShell test | Test-MtAdComputerUnconstrainedDelegationCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/security/Test.AD-DCOMP-01.ps1 - Documentation:
tests/ad/security/Test.AD-DCOMP-01.md