Privileged AD user not protected against delegation

This vulnerability enables attackers to exploit the Kerberos protocol and gain elevated permissions, allowing them to perform malicious actions. The risk of privilege escalation through unconstrained delegation justifies a high-severity rating.

When a privileged AD user is not protected against delegation, an attacker controlling the account can use the Kerberos protocol to obtain a ticket-granting ticket (TGT) and assume the identity of other users or services. This allows them to access sensitive resources and perform actions that would otherwise be restricted.

Cayosoft Guardian detects Privileged AD user not protected against delegation by continuously monitoring Active Directory for privileged accounts that have been configured to allow unconstrained delegation. When such a configuration is found, Guardian flags it as a security issue so administrators are aware of the potential risk.

Cayosoft Guardian helps reduce the risk by alerting administrators to disable unconstrained delegation for privileged accounts in Active Directory Users and Computers, preventing attackers from using delegated Kerberos tickets to assume other identities.