No users should be configured for unconstrained delegation

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Users · All checks

Run this check

Invoke-Maester -TestId AD-USER-29

Overview

Delegation details on user accounts help defenders quickly identify high-risk service identities and prioritize cleanup.

• Risk prioritization: Unconstrained delegation is usually more dangerous than protocol transition alone.
• Account review: User-based service accounts with SPNs and delegation need strong justification.
• Incident response: Detailed visibility speeds triage during suspected Kerberos abuse.

Control Type

Preventive

Security Recommendation

• Review each delegation-enabled user for business need, owner, and scope.
• Remove unnecessary delegation settings.
• Replace legacy service users with safer identity patterns where possible.
• Monitor delegation-enabled accounts for unusual logon or ticket activity.

How the Test Works

This test lists each user with TrustedForDelegation or TrustedToAuthForDelegation enabled and labels the effective delegation type based on the available account flags.

Related Tests

• Test-MtAdUserDelegationConfiguredCount
• Test-MtAdUserKnownServiceAccountDetails

Details

Every attribute of this check

Field	Value
Test ID	AD-USER-29
Severity	High
Suite	Active Directory
Product	Active Directory
Feature	Users
Area	Authentication
Resource type	User
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket
Supports controls	nist-800-53-r5:AC-6
PowerShell test	Test-MtAdUserDelegationDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:user:ReadProperty

Source

• Test: tests/ad/user/Test.AD-USER-29.ps1
• Documentation: tests/ad/user/Test.AD-USER-29.md