# User delegation configured count should be investigated

Delegation on user accounts can be especially risky because user identities are often easier to misuse than computer accounts.

Source: https://maester.dev/docs/tests/AD-USER-28

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Users · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-USER-28
```

## Overview

Delegation on user accounts can be especially risky because user identities are often easier to misuse than computer accounts. Service accounts configured for delegation can become powerful lateral movement pivots.

- **Lateral movement risk**: Delegation can expand the blast radius of compromise.
- **Privilege abuse**: User-based services with delegation deserve special scrutiny.
- **Exposure tracking**: Supports routine review of delegation-enabled identities.

#### Control Type

**Operational**

#### Security Recommendation

- Minimize delegation on user accounts.
- Prefer modern and least-privileged service identity patterns.
- Review all delegation-enabled users for valid business justification.
- Prioritize removal of unnecessary unconstrained delegation.

#### How the Test Works

This test counts user accounts with either `TrustedForDelegation` or `TrustedToAuthForDelegation` enabled and breaks out how many have each flag.

#### Related Tests

- `Test-MtAdUserDelegationDetails`
- `Test-MtAdUserKnownServiceAccountDetails`

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-USER-28 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Users |
| Area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets, T1550.003 Pass the Ticket |
| PowerShell test | [Test-MtAdUserDelegationConfiguredCount](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-28.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:user:ReadProperty |

</details>

## Source

- Test: [`tests/ad/user/Test.AD-USER-28.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-28.ps1)
- Documentation: [`tests/ad/user/Test.AD-USER-28.md`](https://github.com/maester365/maester/blob/main/tests/ad/user/Test.AD-USER-28.md)