Active › Module 6 › Lesson 3
Delegation Named
Kerberos delegation types named — unconstrained, constrained, RBCD — literacy and hardening on $LAB_AD, not stranger-domain abuse recipes.
Visual · t25_delegation_named
Delegation = named Kerberos trust misuse classes. Harden first. $LAB_AD only. Original Cyberlium.
Opening
Delegation lets services act as users — misconfiguration is a defender ticket, not a free pass to impersonate strangers.
Kerberos delegation literacy names: unconstrained delegation (T1558.001 context — service can cache TGTs), constrained delegation (S4U2self/S4U2proxy to specified SPNs), resource-based constrained delegation RBCD (msDS-AllowedToActOnBehalfOfOtherIdentity). Analyst maps each to risk: unconstrained on member server = high, RBCD mis-ACL = lateral path category. Defenders: avoid unconstrained, audit TRUSTED_FOR_DELEGATION, monitor 4769 anomalies, limit who can edit RBCD attributes. Cyberlium names types on YOUR $LAB_AD — NOT RBCD takeover cookbooks on stranger domains, NOT configuring delegation on systems you do not admin, NOT S4U abuse walkthroughs against production. Lab row: one delegation type found in lab with hardening recommendation.
1. Three delegation classes
Unconstrained: service stores user TGTs — legacy high risk.
Constrained: allowed SPN list. RBCD: resource decides who can delegate — ACL-sensitive.
Command guide
Try these commands — Three delegation classes
═══ WINDOWS / POWERSHELL (Lab DC) ═══
Audit users and groups with 'Replicating Directory Changes' rights (DCSync privilege)
Command — copy this
Import-Module ActiveDirectory
(Get-Acl "AD:\$((Get-ADDomain).DistinguishedName)").Access | Where-Object {
$_.ActiveDirectoryRights -match "ExtendedRight" -and
($_.ObjectType -eq "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" -or $_.ObjectType -eq "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2")
} | Select-Object IdentityReference, ActiveDirectoryRightsAudit unconstrained or constrained delegation accounts
Command — copy this
Get-ADAccount -Filter {TrustedForDelegation -eq $true} | Select-Object Name, SamAccountNamePrimary tools to practice this lesson: curl, python3. Reference sites: MITRE T1558.001 Unconstrained Delegation (https://attack.mitre.org/techniques/T1558/001/); MITRE T1558.002 Constrained Delegation (https://attack.mitre.org/techniques/T1558/002/); Microsoft delegation (https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender hardening
Eliminate unconstrained where possible, audit delegation flags, restrict RBCD edit rights.
Monitor Kerberos 4769 for unusual delegation patterns on Tier 0 assets.
3. Refused use
No delegation abuse recipes on unauthorized AD, no 'RBCD to DA' homework on employer forest.
Literacy output: type name + risk + fix — not impersonation proof on stranger DC.
4. What you ship: delegation literacy card
Three types defined + one lab misconfig row + hardening trio + scope line.
5. What you record before the next lesson
Delegation literacy card path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Configure RBCD on production app server without change board to 'learn delegation.'
Right
Delegation types named with hardening. Next: Paths Lab.
Mission: delegation literacy card
1) Define unconstrained constrained RBCD one line each. 2) One $LAB_AD misconfig row. 3) List three hardening actions. 4) Write NEVER stranger-domain delegation abuse.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “RBCD — which ACL edits to audit?”
Knowledge Check
APPLY: Unconstrained delegation risk:
Multiple choice
Knowledge Check
APPLY: True or False: RBCD takeover cookbook on stranger AD is lab.
True or False
Knowledge Check
APPLY: Defenders reduce delegation abuse by:
Multiple choice