Un-Constrained Delegation

Configure Lab

Log on to the DC and open the manage computers and users tool (server manager > Tools > Active Directory users and computers).
Go onto the computers tab.
Right click on the comp and go into properties > delegation.
Click on the allow delegation for all services.
Apply.

Abuse

Can use printerbug to abuse and auth as DC, then can DCSync.
​

Fix

Same steps as before but remove the delegation completely.
Last modified 2yr ago