Non-DC computers should not have unconstrained delegation

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Computers · All checks

Run this check

Invoke-Maester -TestId AD-DCOMP-02

Overview

• Non-domain controller computers with unconstrained delegation represent a CRITICAL security vulnerability. While domain controllers may have legitimate reasons for unconstrained delegation in certain legacy scenarios, regular computers should NEVER have this configuration.

Critical Security Risks:

• Domain Compromise: A single compromised computer with unconstrained delegation can lead to full domain compromise
• Unrestricted Impersonation: Any service on the computer can impersonate any domain user to any service
• Attack Vector: Common target for attackers seeking to escalate privileges
• Stealthy Access: Can be exploited without triggering typical security alerts

The target count for this test should ALWAYS be ZERO.

Control Type

Detective

Security Recommendation

1. Immediate Action Required:

   • Identify all non-DC computers with unconstrained delegation
   • Remove unconstrained delegation immediately
   • Investigate why it was configured

2. Replace with secure alternatives:

   • Constrained Delegation: Limit to specific required services
   • Resource-Based Constrained Delegation: Modern, flexible approach
   • Managed Service Accounts: Use gMSAs where possible

3. Audit and Monitor:

   • Regular audits of delegation settings
   • Alert on any new unconstrained delegation configurations
   • Review applications requiring delegation

How the Test Works

This test specifically identifies non-DC computers with the TrustedForDelegation flag enabled and reports:

• Count of affected computers
• Computer names and operating systems
• Compliance status (should be zero)

Pass Criteria: Zero non-DC computers with unconstrained delegation

Related Tests

• Test-MtAdComputerUnconstrainedDelegationCount - Overall unconstrained delegation count
• Test-MtAdComputerNonDcConstrainedDelegationCount - Reviews constrained delegation on non-DCs
• Test-MtAdComputerDelegationCount - General delegation overview

Related links

• Microsoft Defender for Identity: Unsecure Kerberos delegation
• ANSSI Active Directory checkpoints: Unconstrained authentication delegation

Details

Every attribute of this check

Field	Value
Test ID	AD-DCOMP-02
Severity	High
Suite	Active Directory
Product	Active Directory
Feature	Computers
Area	Authentication
Resource type	Computer
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket
Supports controls	nist-800-53-r5:AC-6
PowerShell test	Test-MtAdComputerNonDcUnconstrainedDelegationCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:computer:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty

Source

• Test: tests/ad/security/Test.AD-DCOMP-02.ps1
• Documentation: tests/ad/security/Test.AD-DCOMP-02.md