# Non-DC computers with constrained delegation count should be investigated

Security Considerations: - Limited Scope: Safer than unconstrained but still enables impersonation - Configuration Complexity: Easy to misconfigure and…

Source: https://maester.dev/docs/tests/AD-DCOMP-03

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Computers · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-DCOMP-03
```

## Overview

- Constrained delegation (also known as "protocol transition" or S4U2Proxy) is safer than unconstrained delegation but still carries security risks. It allows a service to impersonate a user to specific services only, rather than any service in the domain.

**Security Considerations:**
- **Limited Scope**: Safer than unconstrained but still enables impersonation
- **Configuration Complexity**: Easy to misconfigure and accidentally grant excessive permissions
- **Attack Surface**: Each computer with constrained delegation expands the attack surface
- **Legacy Protocol**: Some implementations may fall back to less secure methods

#### Control Type

**Operational**

#### Security Recommendation

1. **Minimize Usage**:
   - Use only where absolutely necessary
   - Regular review of all constrained delegation configurations
   - Document business justification for each instance

2. **Secure Configuration**:
   - Limit to specific SPNs (Service Principal Names)
   - Use protocol transition only when required
   - Regular auditing of delegation settings

3. **Consider Modern Alternatives**:
   - **Resource-Based Constrained Delegation**: More flexible and easier to manage
   - **Group Managed Service Accounts (gMSA)**: Automatic password management
   - **Managed Identity**: For cloud and hybrid scenarios

#### How the Test Works

This test counts non-DC computers with the `TrustedToAuthForDelegation` flag enabled, which indicates:
- Constrained delegation is configured
- Protocol transition may be enabled

#### Related Tests

- `Test-MtAdComputerUnconstrainedDelegationCount` - Overall unconstrained delegation
- `Test-MtAdComputerNonDcUnconstrainedDelegationCount` - Critical non-DC unconstrained delegation
- `Test-MtAdUserDelegationConfiguredCount` - User account delegation settings

#### Related links

- [Microsoft Defender for Identity: Unsecure Kerberos delegation](https://learn.microsoft.com/defender-for-identity/security-posture-assessments/accounts#unsecure-kerberos-delegation)
- [ANSSI Active Directory checkpoints: Constrained authentication delegation to privileged service](https://www.cert.ssi.gouv.fr/uploads/ad_checklist.html#vuln_delegation_a2d2)
- [ANSSI Active Directory checkpoints: Constrained delegation with protocol transition to a privileged service](https://www.cert.ssi.gouv.fr/uploads/ad_checklist.html#vuln_delegation_t2a4d)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-DCOMP-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Computers |
| Area | Authentication |
| Resource type | Computer |
| MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket |
| PowerShell test | [Test-MtAdComputerNonDcConstrainedDelegationCount](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-03.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:computer:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty |

</details>

## Source

- Test: [`tests/ad/security/Test.AD-DCOMP-03.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-03.ps1)
- Documentation: [`tests/ad/security/Test.AD-DCOMP-03.md`](https://github.com/maester365/maester/blob/main/tests/ad/security/Test.AD-DCOMP-03.md)