Resource-Based Constrained Delegation: AD Security 101

Theory behind the Kerberos Bronze Bit attack (CVE-2020-17049), which abuses a KDC flaw to bypass delegation checks in resource-based constrained delegation attacks against Active Directory.

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

Delegating user management in AD requires least privilege, yet legacy rights like password options reachable by Authenticated Users can silently widen access. The post shows how to harden it.

Kevin Robertson details ten attacker rules for MachineAccountQuota, which lets unprivileged users add up to 10 machine accounts, plus Powermad techniques and the defense of setting MAQ to 0.

Poorly managed AD ACLs enable domain escalation. The post explains a tiered delegation model—Tier 0 domain controllers, Tier 1 servers, Tier 2 user administration—to enforce least privilege.

CVE-2014-6324 (MS14-068): any authenticated domain user could forge a Kerberos ticket with a tampered PAC to reach Domain Admin—a critical Windows KDC flaw, fixed by correcting signature verification.