Detent PointBusiness value for administrators who manage Active Directory delegation is to identify resource-based constrained delegation (RBCD) grants and their associated principals. This knowledge helps prevent stale RBCD entries from decommissioned services, which can lead to security misconfigurations.
- Potential risks include:
- Misconfigured RBCD grants allowing unauthorized access
- Inability to detect orphaned RBCD entries due to stale or missing principals
- A manager should care about this when:
- Regularly auditing Active Directory delegation configurations for potential issues
- Identifying and correcting misconfigurations that can lead to security vulnerabilities
Day-to-day use involves running Get-RbcdDelegationAudit in PowerShell, which queries Active Directory for objects with the msDS-AllowedToActOnBehalfOfOtherIdentity attribute set. The command returns one DelegationFinding object per resource.
- Run the following command to find accounts with RBCD configured:
Get-RbcdDelegationAudit- The output will contain information about each resource, including principals allowed to act on its behalf.
- Watchpoints:
- Ensure you have the necessary permissions to query Active Directory
- Be cautious when interpreting results, as orphaned RBCD entries may indicate a decommissioned service
In simple terms, Get-RbcdDelegationAudit finds accounts with resource-based constrained delegation (RBCD) configured and resolves who can delegate to them. It helps prevent security misconfigurations by identifying stale or missing principals.
Here’s how you can use it:
- Run the command in PowerShell:
Get-RbcdDelegationAudit - Review the output, which will contain information about each resource with RBCD grants
- If you encounter issues or need further assistance, refer to the documentation or seek help from a qualified administrator
| Field | Value |
|---|---|
| Vendor | Detent Point LLC |
| Product | SpnManager 0.4.0 |
| Licence | Proprietary - licensed, not sold. See LICENSE. |
| Operational impact | Read-only. Queries Active Directory and reports findings; changes nothing. |
| Rights required | Directory read access. |
| Providers covered | Audit.RBCD |
| Approval recommendation | Approve for general operational use. It cannot alter directory state. |
Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.
| What | Why |
|---|---|
| Windows PowerShell 5.1 or later | Declared by the module manifest. |
| ActiveDirectory 1.0.0.0 | Required module. Ships with RSAT; install the Active Directory PowerShell feature. |
| A reachable domain controller | Every provider reads from Active Directory. |
| An account with directory read access | Needed to enumerate accounts and their SPNs. |
- Data handling: The command only retrieves information from Active Directory and does not modify or store data.
- Transit: Data is transmitted over a secure connection (PSRemoting) when running on remote systems.
- At rest: No sensitive data is stored persistently by the
Get-RbcdDelegationAuditcommand. - Audit trail: Output can be used to track changes and identify potential security misconfigurations.
- Compliance requirements:
- Follow standard procedures for querying and accessing Active Directory.
- Ensure adequate permissions are granted to run the command.
This is the sense step. It reads the current state and produces a candidate; nothing is changed. Providers: Audit.RBCD.
Example 1
Get-RbcdDelegationAuditExample 2
Get-RbcdDelegationAudit -SearchBase 'OU=Servers,DC=corp,DC=example,DC=com'Example 3
Get-RbcdDelegationAudit | Where-Object { $_.OrphanedSids.Count -gt 0 }