> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs.md).

# Active Directory Abuse: Kerberos, Delegation, and AD CS

Active Directory abuse usually follows a trust path, not a single exploit.

Kerberos proves identity. Delegation extends identity across services. AD CS can mint credentials that let attackers step around normal controls.

This section breaks that chain into parts you can study in order.

### Why this matters

Most Windows environments do not fail because one setting is wrong.

They fail because several acceptable settings combine into a dangerous path. A service account has an SPN. A host trusts delegation. A certificate template allows weak enrollment. Together, those become lateral movement or domain compromise.

<figure><img src="/files/zV9G3nZlpuhiNaf4RJ79" alt=""><figcaption></figcaption></figure>

Start with three questions:

1. Who can request or relay trust?
2. Which services can impersonate users?
3. Which identities can mint new credentials?

That frame helps you reason about Kerberos, delegation, and AD CS without getting lost in flags and acronyms.

### What to read first

{% stepper %}
{% step %}

### Kuberos Primer

If you want the protocol model first, start with the Kerberos primer.
{% endstep %}

{% step %}

### Delegation

If you care about service impersonation, read the delegation pages next.
{% endstep %}

{% step %}

### AD CS

If you want certificate abuse paths, jump into AD CS fundamentals and escalation paths.
{% endstep %}
{% endstepper %}

### Defensive priorities

Four controls matter most:

* Reduce unnecessary SPNs and over-privileged service accounts.
* Audit unconstrained delegation and `TrustedToAuthForDelegation`.
* Review certificate templates for risky enrollment settings.
* Protect sensitive users from delegation where possible.

### Pages in this section

The supporting pages below turn the original note set into focused references.

* [Kerberos Primer](/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs/kerberos-primer.md)
* [Delegation Overview](/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs/delegation-overview.md)
* [Delegation Attack Paths](/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs/delegation-attack-paths.md)
* [AD CS Fundamentals](/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs/ad-cs-fundamentals.md)
* [AD CS Escalation Paths](/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs/ad-cs-escalation-paths.md)
* [Glossary](/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs/glossary.md)