Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Unconstrained Delegation in Active Directory

semperis.com | blog | #active-directory | #kerberos | #hardening | #misconfigurations | #unconstrained-delegation

Summary

Why unconstrained delegation is among AD's worst security gaps: it lets a computer store users' Kerberos tickets and impersonate them, making it a prime target; removing the setting eliminates a weak link in trusted authentication chains.
Published
Collected

original ↗

Related coverage

blog · semperis.com
Unconstrained Delegation Explained
Unconstrained delegation lets a service impersonate users across the domain; attackers hunt such servers, capture Kerberos TGTs with Rubeus, and move laterally. Mechanics and remediation covered.
blog · semperis.com
NSA Top Ten Cybersecurity Misconfigurations: An Active Directory Perspective
Part 1 of the CISA/NSA top ten misconfigurations series for AD: default configurations, improper privilege separation, and lack of internal monitoring, with remediation guidance.
blog · semperis.com
What is Active Directory Security?
AD security primer: AD holds the keys to most on-prem apps; top risks include unconstrained Kerberos delegation and over-permissioned users. Includes hardening best practices.
blog · blog.sentry.security
Domain Takeover via Kerberos Unconstrained Delegation
How attackers abuse Active Directory unconstrained delegation: coercing a DC to authenticate to a compromised host captures its TGT, enabling DCSync, Golden Tickets and full domain takeover.
incident · semperis.com
7 Active Directory Misconfigurations to Find and Fix—Now
Seven Active Directory misconfigurations to find and fix, starting with non-default principals holding DCSync rights and AdminSDHolder permission tampering; each item includes detection pointers and remediation steps.
blog · semperis.com
What Should You Install on Your Domain Controllers?
A domain controller should do one thing: control the domain. Why ADDS belongs on a DC and which roles, tools, and apps to keep off it to shrink the attack surface.
back