User delegation configured count should be investigated
AD-USER-28InfoActive DirectoryUsers
Part of Active Directory · Active Directory · Users · All checks
Invoke-Maester -TestId AD-USER-28Overview
Section titled “Overview”Delegation on user accounts can be especially risky because user identities are often easier to misuse than computer accounts. Service accounts configured for delegation can become powerful lateral movement pivots.
- Lateral movement risk: Delegation can expand the blast radius of compromise.
- Privilege abuse: User-based services with delegation deserve special scrutiny.
- Exposure tracking: Supports routine review of delegation-enabled identities.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Minimize delegation on user accounts.
- Prefer modern and least-privileged service identity patterns.
- Review all delegation-enabled users for valid business justification.
- Prioritize removal of unnecessary unconstrained delegation.
How the Test Works
Section titled “How the Test Works”This test counts user accounts with either TrustedForDelegation or TrustedToAuthForDelegation enabled and breaks out how many have each flag.
Related Tests
Section titled “Related Tests”Test-MtAdUserDelegationDetailsTest-MtAdUserKnownServiceAccountDetails
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-USER-28 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket |
| PowerShell test | Test-MtAdUserDelegationConfiguredCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/user/Test.AD-USER-28.ps1 - Documentation:
tests/ad/user/Test.AD-USER-28.md