Skip to content
MitoMito Docs

AD-COMP-09: Computer delegation count should be retrievable
ID AD-COMP-09
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Computers
Security area Authentication
Resource type Computer
MITRE ATT&CK T1558, T1550.003
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Kerberos delegation allows a service to impersonate users when accessing other resources. While necessary for some applications, delegation—especially unconstrained delegation—creates significant security risks:

  • Unconstrained delegation: The service can impersonate users to ANY service on ANY system (highest risk)
  • Constrained delegation: Limited to specific services, but still requires careful management
  • Protocol transition: Allows S4U2Self/S4U2Proxy operations that can be exploited
  • Lateral movement: Attackers can abuse delegation for privilege escalation and lateral movement

Control Type

Section titled “Control Type”

Detective

Security Recommendation

Section titled “Security Recommendation”
  • Minimize unconstrained delegation: Use it only when absolutely necessary, and never on tier 0 systems
  • Prefer constrained delegation: Limit services to only those they need to access
  • Use resource-based constrained delegation: More secure alternative in modern environments
  • Regular audits: Periodically review which computers have delegation enabled
  • Remove unused delegation: Disable delegation on systems that no longer require it
  • Consider Group Managed Service Accounts (gMSA): These provide better security for service accounts

How the Test Works

Section titled “How the Test Works”

This test counts computers with different delegation configurations:

  • TrustedForDelegation (unconstrained delegation)
  • TrustedToAuthForDelegation (constrained delegation with protocol transition)
Section titled “Related Tests”
  • Test-MtAdComputerDelegationDetails - Provides detailed breakdown of delegation per computer
  • Test-MtAdComputerDormantCount - Identifies stale accounts that may have delegation enabled

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.