AD-USER-29: No users should be configured for unconstrained delegation
| ID | AD-USER-29 |
| Severity | High |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Users |
| Security area | Authentication |
| Resource type | User |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:AC-6 Least Privilege |
| MITRE ATT&CK | T1558, T1550.003 |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Delegation details on user accounts help defenders quickly identify high-risk service identities and prioritize cleanup.
- Risk prioritization: Unconstrained delegation is usually more dangerous than protocol transition alone.
- Account review: User-based service accounts with SPNs and delegation need strong justification.
- Incident response: Detailed visibility speeds triage during suspected Kerberos abuse.
Control Type
Section titled “Control Type”Preventive
Security Recommendation
Section titled “Security Recommendation”- Review each delegation-enabled user for business need, owner, and scope.
- Remove unnecessary delegation settings.
- Replace legacy service users with safer identity patterns where possible.
- Monitor delegation-enabled accounts for unusual logon or ticket activity.
How the Test Works
Section titled “How the Test Works”This test lists each user with TrustedForDelegation or TrustedToAuthForDelegation enabled and labels the effective delegation type based on the available account flags.
Related Tests
Section titled “Related Tests”Test-MtAdUserDelegationConfiguredCountTest-MtAdUserKnownServiceAccountDetails
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.