AD-DCOMP-03: Non-DC computers with constrained delegation count should be investigated

Not run by Mito

This check reads an on-premises Active Directory forest. Mito assesses your Microsoft 365 tenant in the cloud and does not run it. It is listed for reference only.

ID	AD-DCOMP-03
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Computers
Security area	Authentication
Resource type	Computer
MITRE ATT&CK	T1558, T1550.003
Reads from	On-premises Active Directory

What this checks and how to fix it

• Constrained delegation (also known as “protocol transition” or S4U2Proxy) is safer than unconstrained delegation but still carries security risks. It allows a service to impersonate a user to specific services only, rather than any service in the domain.

Security Considerations:

• Limited Scope: Safer than unconstrained but still enables impersonation
• Configuration Complexity: Easy to misconfigure and accidentally grant excessive permissions
• Attack Surface: Each computer with constrained delegation expands the attack surface
• Legacy Protocol: Some implementations may fall back to less secure methods

Control Type

Operational

Security Recommendation

1. Minimize Usage:

   • Use only where absolutely necessary
   • Regular review of all constrained delegation configurations
   • Document business justification for each instance

2. Secure Configuration:

   • Limit to specific SPNs (Service Principal Names)
   • Use protocol transition only when required
   • Regular auditing of delegation settings

3. Consider Modern Alternatives:

   • Resource-Based Constrained Delegation: More flexible and easier to manage
   • Group Managed Service Accounts (gMSA): Automatic password management
   • Managed Identity: For cloud and hybrid scenarios

How the Test Works

This test counts non-DC computers with the TrustedToAuthForDelegation flag enabled, which indicates:

• Constrained delegation is configured
• Protocol transition may be enabled

Related Tests

• Test-MtAdComputerUnconstrainedDelegationCount - Overall unconstrained delegation
• Test-MtAdComputerNonDcUnconstrainedDelegationCount - Critical non-DC unconstrained delegation
• Test-MtAdUserDelegationConfiguredCount - User account delegation settings

Related links

• Microsoft Defender for Identity: Unsecure Kerberos delegation
• ANSSI Active Directory checkpoints: Constrained authentication delegation to privileged service
• ANSSI Active Directory checkpoints: Constrained delegation with protocol transition to a privileged service

---

Mito check. Author: soulemike. Open-source licences.