AD-USER-05: Delegation-enabled user count should be retrievable
| ID | AD-USER-05 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Authentication |
| Resource type | User |
| MITRE ATT&CK | T1558, T1550.003 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Delegation-capable user accounts can impersonate users to downstream services. If these accounts are over-privileged or poorly protected, they can become valuable pivot points for privilege escalation and lateral movement.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”Limit delegation to only the accounts that need it, prefer constrained models, and protect delegated accounts with strong authentication, tiering, and monitoring.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory user data from Get-MtADDomainState and counts accounts where TrustedForDelegation or TrustedToAuthForDelegation is enabled. The results break out delegation types and show the overall count.
Related Tests
Section titled “Related Tests”Test-MtAdUserNoPreAuthCountTest-MtAdUserKerberosDesOnlyCountTest-MtAdUserPasswordNeverExpiresCount
Related links
Section titled “Related links”- Microsoft Defender for Identity: Ensure privileged accounts are not delegated
- ANSSI Active Directory checkpoints: Unconstrained authentication delegation
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.