AD-USER-28: User delegation configured count should be investigated
| ID | AD-USER-28 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558, T1550.003 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Delegation on user accounts can be especially risky because user identities are often easier to misuse than computer accounts. Service accounts configured for delegation can become powerful lateral movement pivots.
- Lateral movement risk: Delegation can expand the blast radius of compromise.
- Privilege abuse: User-based services with delegation deserve special scrutiny.
- Exposure tracking: Supports routine review of delegation-enabled identities.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Minimize delegation on user accounts.
- Prefer modern and least-privileged service identity patterns.
- Review all delegation-enabled users for valid business justification.
- Prioritize removal of unnecessary unconstrained delegation.
How the Test Works
Section titled “How the Test Works”This test counts user accounts with either TrustedForDelegation or TrustedToAuthForDelegation enabled and breaks out how many have each flag.
Related Tests
Section titled “Related Tests”Test-MtAdUserDelegationDetailsTest-MtAdUserKnownServiceAccountDetails
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.