> For the complete documentation index, see [llms.txt](https://cheats.philkeeble.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cheats.philkeeble.com/active-directory/ad-privilege-escalation/un-constrained-delegation.md).

# Un-Constrained Delegation

## Configure Lab

Log on to the DC and open the manage computers and users tool (server manager > Tools > Active Directory users and computers).

Go onto the computers tab.

Right click on the comp and go into properties > delegation.

Click on the allow delegation for all services. 

Apply.

## Abuse

Can use printerbug to abuse and auth as DC, then can DCSync.

## Fix 

Same steps as before but remove the delegation completely.