Skip to content
MitoMito Docs

AD-DCOMP-02: Non-DC computers should not have unconstrained delegation
ID AD-DCOMP-02
Severity High
Suite Active Directory (on-premises)
Product Active Directory
Feature Computers
Security area Authentication
Resource type Computer
User impact of fixing Low
Effort to fix Medium
Framework controls nist-800-53-r5:AC-6 Least Privilege
MITRE ATT&CK T1558, T1550.003
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”
  • Non-domain controller computers with unconstrained delegation represent a CRITICAL security vulnerability. While domain controllers may have legitimate reasons for unconstrained delegation in certain legacy scenarios, regular computers should NEVER have this configuration.

Critical Security Risks:

  • Domain Compromise: A single compromised computer with unconstrained delegation can lead to full domain compromise
  • Unrestricted Impersonation: Any service on the computer can impersonate any domain user to any service
  • Attack Vector: Common target for attackers seeking to escalate privileges
  • Stealthy Access: Can be exploited without triggering typical security alerts

The target count for this test should ALWAYS be ZERO.

Control Type

Section titled “Control Type”

Detective

Security Recommendation

Section titled “Security Recommendation”

  1. Immediate Action Required:

    • Identify all non-DC computers with unconstrained delegation
    • Remove unconstrained delegation immediately
    • Investigate why it was configured

  2. Replace with secure alternatives:

    • Constrained Delegation: Limit to specific required services
    • Resource-Based Constrained Delegation: Modern, flexible approach
    • Managed Service Accounts: Use gMSAs where possible

  3. Audit and Monitor:

    • Regular audits of delegation settings
    • Alert on any new unconstrained delegation configurations
    • Review applications requiring delegation

How the Test Works

Section titled “How the Test Works”

This test specifically identifies non-DC computers with the TrustedForDelegation flag enabled and reports:

  • Count of affected computers
  • Computer names and operating systems
  • Compliance status (should be zero)

Pass Criteria: Zero non-DC computers with unconstrained delegation

Section titled “Related Tests”
  • Test-MtAdComputerUnconstrainedDelegationCount - Overall unconstrained delegation count
  • Test-MtAdComputerNonDcConstrainedDelegationCount - Reviews constrained delegation on non-DCs
  • Test-MtAdComputerDelegationCount - General delegation overview
Section titled “Related links”

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.