Get-UnconstrainedDelegationAudit

Managers care about unconstrained Kerberos delegation exposures because they can lead to security breaches and unauthorized access to sensitive resources. This command helps identify high-risk accounts that can forward service tickets to downstream services, posing a significant threat.

• Who uses this: Security teams, auditors, and anyone responsible for ensuring the integrity of Active Directory.
• Risks:
  • Unconstrained delegation exposes sensitive resources to potential security breaches.
  • Can lead to unauthorized access to sensitive data or systems.
  • Silently missed delegated service accounts can go undetected until a breach occurs.
• When a manager cares: During regular security audits, when new services are added to the environment, or after detecting suspicious activity.

Day-to-Day Use

1. Run Get-UnconstrainedDelegationAudit in PowerShell to identify at-risk accounts.
2. Review the output, which includes one DelegationFinding object per account found.
3. Use the -SearchBase parameter to restrict the scope to a specific OU subtree.

# Example usage:
$results = Get-UnconstrainedDelegationAudit -SearchBase "OU=Sales,DC=Example,DC=com"

Common Patterns

• Running Get-UnconstrainedDelegationAudit as part of regular security audits.
• Using the -SearchBase parameter to scope searches to specific OU subtrees.

Watchpoints

• Ensure proper permissions when running this command against large Active Directory environments.
• Consider scheduling regular runs of this command to monitor for changes in unconstrained delegation configurations.

What This Does

This command finds user, service, and computer accounts configured for unconstrained Kerberos delegation. It then excludes Domain Controllers (which should have legitimate unconstrained delegation) from the results.

1. Run Get-UnconstrainedDelegationAudit to identify at-risk accounts.
2. Review the output to see which accounts require attention.
3. If unsure about any result, consult with an Active Directory expert or security team member.

Recipes

• Recipe 1: Identify all user and computer accounts configured for unconstrained delegation.
  • Run Get-UnconstrainedDelegationAudit without any parameters.
• Recipe 2: Restrict the search to a specific OU subtree.
  • Use the -SearchBase parameter with the desired OU path.

Getting Help

If stuck, consult the following resources: * PowerShell documentation for Get-UnconstrainedDelegationAudit * SpnManager module wiki (including this Insights document) * Active Directory and security forums or communities

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

This command respects the following compliance requirements:

• Data-handling: Retrieves only authorized data from Active Directory.
• Transit: Transmits data securely using encrypted channels (if applicable).
• At-rest: Stores no sensitive data, and results are ephemeral.
• Audit trail: Results can be used to track changes in unconstrained delegation configurations over time.

Compliance requirements not explicitly mentioned above may still apply depending on specific organizational policies or regulations. Consult with relevant experts for detailed guidance.