Delegation-enabled user count should be retrievable
AD-USER-05InfoActive DirectoryUsers
Part of Active Directory · Active Directory · Users · All checks
Invoke-Maester -TestId AD-USER-05Overview
Section titled “Overview”Delegation-capable user accounts can impersonate users to downstream services. If these accounts are over-privileged or poorly protected, they can become valuable pivot points for privilege escalation and lateral movement.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Limit delegation to only the accounts that need it, prefer constrained models, and protect delegated accounts with strong authentication, tiering, and monitoring.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts where TrustedForDelegation or TrustedToAuthForDelegation is enabled. The results break out delegation types and show the overall count.
Related Tests
Section titled “Related Tests”Test-MtAdUserNoPreAuthCountTest-MtAdUserKerberosDesOnlyCountTest-MtAdUserPasswordNeverExpiresCount
Related links
Section titled “Related links”- Microsoft Defender for Identity: Ensure privileged accounts are not delegated
- ANSSI Active Directory checkpoints: Unconstrained authentication delegation
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-05 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket |
| PowerShell test | Test-MtAdUserDelegationAllowedCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-05.ps1 - Documentation:
tests/ad/user/Test.AD-USER-05.md