Delegation risks
You get to know the three forms of Kerberos delegation (unconstrained, constrained, resource-based); you find servers with unconstrained delegation, which services constrained delegation opens, protocol transition (tickets on behalf of any user) and admins without the cannot-be-delegated flag, decode userAccountControl bits yourself and prepare the delegation inventory and findings report. The delegation settings are different in every lab.
Level 201 · 50 min
A user opens the intranet, and the intranet must fetch data from the database on the user’s behalf. That is what Kerberos delegation is for: a service can connect to another service in the user’s place. It is useful, but if set up wrongly, an attacker who takes over one server can impersonate everyone who connects to it, administrators included.
Analogy: a power of attorney. Unconstrained delegation is a general power of attorney telling the server "do anything anywhere in my name": the server keeps the ticket of everyone who connects to it. Constrained delegation is a limited one: "only at this bank, only for this". Resource-based delegation (RBCD) is when the bank itself, not the person giving the power, says "I accept powers of attorney coming from this person".
In this lesson you only find and report delegation settings; we don’t go into ways of abusing them. After the lab starts, this lab’s own settings are made in the background; after about 30 seconds everything is in place.
What you will do in this lesson
- Unconstrained delegation: TRUSTED_FOR_DELEGATION
- Constrained delegation: msDS-AllowedToDelegateTo
- Protocol transition: a ticket without authentication
- Decode userAccountControl yourself
- Admins that cannot be delegated
- Resource-based delegation (RBCD)
- Where does the delegation lead?
- The delegation inventory
- The delegation report
- Short quiz
Skills you will earn
- Finding unconstrained delegation (TRUSTED_FOR_DELEGATION)
- Reading constrained delegation and its targets (msDS-AllowedToDelegateTo)
- Finding delegation with protocol transition (TRUSTED_TO_AUTH_FOR_DELEGATION)
- Filtering userAccountControl bits with the 803/804 rules
- Finding admin accounts that can still be delegated
- Auditing resource-based delegation (RBCD)
- Taking an inventory of all delegation in the domain
- Writing audit findings into a report
← Group Policy (GPO) basics · Active Directory security: auditing and hardening · Object permissions (ACLs) and dangerous rights →
Start for free