Skip to content
MitoMito Docs

AD-DCOMP-01: Computers with unconstrained delegation count should be investigated
ID AD-DCOMP-01
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Computers
Security area Authentication
Resource type Computer
MITRE ATT&CK T1558, T1550.003
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”
  • Unconstrained delegation is one of the most dangerous configurations in Active Directory. When enabled on a computer, it allows services on that computer to impersonate authenticated users to ANY service on ANY computer in the domain.

Security Risks:

  • Complete Impersonation: Attackers can impersonate any user who authenticates to the computer
  • Lateral Movement: Compromising one computer with unconstrained delegation enables access to all domain resources
  • Privilege Escalation: Can be used to escalate from standard user to domain admin
  • Ticket Theft: Attackers can harvest TGTs from memory on these computers

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

  1. Eliminate unconstrained delegation:

    • Replace with constrained delegation or resource-based constrained delegation
    • Audit all computers with this setting
    • Prioritize non-DC computers for remediation

  2. Protect computers that require delegation:

    • Limit to absolute minimum necessary
    • Place in isolated OU with strict access controls
    • Monitor for compromise indicators

  3. Use alternatives:

    • Constrained Delegation: Limits impersonation to specific services
    • Resource-Based Constrained Delegation: More flexible and secure approach
    • Protocol Transition: When combined with constrained delegation

How the Test Works

Section titled “How the Test Works”

This test counts computers with the TrustedForDelegation flag enabled and categorizes them by:

  • Domain Controllers vs. non-DC computers
  • Total count and percentage
Section titled “Related Tests”
  • Test-MtAdComputerNonDcUnconstrainedDelegationCount - Focuses on non-DC computers (critical risk)
  • Test-MtAdComputerNonDcConstrainedDelegationCount - Reviews constrained delegation
  • Test-MtAdUserDelegationConfiguredCount - Reviews user account delegation
Section titled “Related links”

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.