> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs/delegation-attack-paths.md).

# Delegation Attack Paths

Practical ways to enumerate and abuse Active Directory delegation settings during an assessment.

Delegation attacks start with enumeration.

The goal is simple: find service-bearing accounts, find delegation settings, and find a path where impersonation crosses a trust boundary.

### What to look for first

Prioritize these findings:

* Hosts with unconstrained delegation.
* Accounts with `TrustedToAuthForDelegation`.
* Non-empty `msDS-AllowedToDelegateTo` values.
* Writable RBCD on interesting servers.
* Machine account creation paths through `MachineAccountQuota`.

### PowerView queries

These commands are high-value starting points.

```powershell
Get-DomainComputer -Unconstrained
Get-DomainComputer -TrustedToAuth -Properties distinguishedname,msds-allowedtodelegateto,useraccountcontrol -Verbose | fl
Get-DomainUser -TrustedToAuth -Properties distinguishedname,msds-allowedtodelegateto,useraccountcontrol | fl
Get-DomainUser -AllowDelegation
Get-DomainUser -DisallowDelegation
```

If an account has `TRUSTED_TO_AUTH_FOR_DELEGATION`, compromise of that account can enable impersonation to the SPNs listed in `msDS-AllowedToDelegateTo`.

### Unconstrained delegation abuse

Unconstrained delegation is often the cleanest escalation path.

If you control a host or service trusted for unconstrained delegation, wait for privileged users to authenticate. Their Kerberos material may become available for replay or extraction.

This gets especially dangerous on shared infrastructure, management servers, or anything administrators touch routinely.

### Constrained delegation abuse

Constrained delegation becomes practical when you control a service account with useful SPNs.

If that account can request tickets to a target service through `msDS-AllowedToDelegateTo`, S4U2Self plus S4U2Proxy may let you impersonate another user to that target.

The key questions are:

1. Does the account own an SPN?
2. Is protocol transition enabled?
3. Is the target user protected from delegation?
4. Is the target service on the allowlist?

### RBCD abuse

RBCD is often easier to weaponize because trust lives on the target object.

If you can write `msDS-AllowedToActOnBehalfOfOtherIdentity` on a server, you can grant an attacker-controlled machine or service the ability to impersonate users to that server.

That is why write access to computer objects matters as much as local admin in some environments.

### Using machine account creation

S4U2Self requires an account with an SPN.

If you do not already control one, `MachineAccountQuota` may let you create a new machine account and gain an SPN-bearing principal to use in the chain.

That small permission often turns an otherwise theoretical RBCD path into a working one.

### Service account to local admin

Service identities such as `NETWORK SERVICE` and IIS app pool identities can sometimes act as the computer account in Active Directory.

That opens a path where an attacker retrieves a machine TGT, uses S4U2Self for a privileged user, then rewrites the target SPN to reach a service on the host or another reachable system.

Tools such as Rubeus make this chain practical.

### Helpful supporting tools

A few tools show up repeatedly in delegation work:

* PowerView or SharpView for LDAP-based enumeration.
* Rubeus for ticket requests, substitution, and import.
* Kekeo for Kerberos ticket operations.
* Impacket for machine creation and service ticket abuse.

### Defensive checks

Review these regularly:

* Systems with unconstrained delegation.
* Accounts with delegation-related UAC flags.
* Computer objects with unexpected RBCD entries.
* New machine accounts created by low-privileged users.

A small number of delegation misconfigurations can produce very large outcomes. Enumeration quality matters more than raw command volume.