Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000049

AD domain account with unconstrained delegation

Critical
Active Directory
Credential Access
v21

Signature Identity

CTD-000049
Threat ID
21
Version
IOE
Indicator Type

Threat Description

  1. Unconstrained Kerberos delegation is a mechanism in which a user sends its credentials to a service to enable the service to access resources on behalf of the user. To enable unconstrained Kerberos delegation, the service’s account in Active Directory must be marked as trusted for delegation.
  2. A lot of modern web applications use this delegation mechanism. For example, a web server can delegate the credentials of authenticated users of the website hosted on that server to any other service in the active directory such as an SMTP server, a file server, a database server, another web server, etc. This is called unconstrained delegation because the application account has the permission to delegate credentials to any service it contacts.
  3. If a threat actor compromises the application, he can use it to act on behalf of other users. If you are logged on as domain admin, the site can create a ticket to whatever other services it wishes, acting as you, the domain admin. For example, the site could choose a domain controller, and make changes to the enterprise admin group. Similarly, the site could acquire the hash of the KRBTGT account, or download a file.

MITRE ATT&CK: Attack Tactics

Credential Access

D3FEND: Defend Tactics

Credential Transmission Scoping

Remediation

To disable unconstrained delegation for an account:

  1. Click Start.
  2. Point to Control Panel.
  3. Point to Administrative Tools.
  4. Click Active Directory Users and Computers.
  5. Find an account with unconstrained delegation enabled.
  6. On the Delegation tab, either disable delegation or select one of the Kerberos constrained delegation (KCD) types.

Frequently Asked Questions

What does AD domain account with unconstrained delegation mean?

AD domain account with unconstrained delegation means a service's account in Active Directory has been granted the right to delegate its credentials without any restrictions, allowing it to access resources on behalf of users. This enables the service to authenticate as other users or services.

An attacker who compromises a service using this mechanism gains unrestricted access to sensitive resources, including domain controllers and administrative groups, allowing for rapid escalation of privileges. This is because the service can authenticate as other users or services, including domain administrators.

An attacker who compromises a service with unconstrained delegation enabled can use the service's credentials to authenticate as other users or services, including domain administrators. This enables the attacker to access sensitive resources and make changes to administrative groups.

Cayosoft Guardian continuously monitors the delegation settings of service accounts in Active Directory, detecting when an account has unconstrained delegation enabled. When detected, Guardian flags it as a security issue so administrators can take corrective action.

Cayosoft Guardian alerts administrators to disable unconstrained delegation for affected accounts, preventing attackers from using compromised services to access sensitive resources. This reduces the blast radius of potential damage and helps maintain the security posture of the Active Directory environment.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection
Attack Tactics
Credential Access
Defend Tactics
Credential Transmission Scoping
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical