Kerberos Delegation: Active Directory Sign-In

Why It Matters

A server trusted for delegation reaches other services as the users who connect to it, so whoever controls that server borrows their identities. Which form is set, and on which accounts, decides how far that goes.

What Happens

Delegation lets a front-end service, such as a web app on srv-app-01, reach a back-end service as the user instead of as itself. Kerberos has three forms, set on different accounts and checked in different places.

With unconstrained delegation (TRUSTED_FOR_DELEGATION on the server's account), the DC marks tickets to that server ok-as-delegate, and the client sends a forwarded copy of its TGT, with its session key, inside the AP request. The server keeps that TGT and can ask for tickets to any service as the user. Every account that signs in to it with Kerberos leaves a usable TGT there, a domain controller's included if one is made to connect.

Constrained delegation lists the services a server may reach in its msDS-AllowedToDelegateTo, and the server presents the user's service ticket to get one for a listed service (S4U2proxy). With protocol transition (TRUSTED_TO_AUTH_FOR_DELEGATION), the ticket a server gets to itself for any user (S4U2self) is forwardable, so it can act for users who never signed in to it with Kerberos. Resource-based delegation turns this round, because the back end's msDS-AllowedToActOnBehalfOfOtherIdentity names the front ends it accepts, so whoever can write that attribute decides.

No form of delegation works for an account marked "Account is sensitive and cannot be delegated", or for a member of Protected Users. Credential Guard on a client also stops it forwarding its TGT to a server with unconstrained delegation. Moving such servers to constrained or resource-based delegation means users' TGTs no longer reach them.

Changes show in the domain controllers' Security logs, as event 4742 for computer accounts and 4738 for user accounts, and as event 5136 for a resource-based change where an audit entry covers the attribute. Delegated requests appear in event 4769 from the delegating server, with Transited Services naming the services a constrained delegation passed through.

The Three Forms of Delegation

The three forms differ in which account carries the setting and how far the server can go. Check each account's setting against this table to judge how much a compromise of that server would give away.

Form	Set On	What the Server Can Do
Unconstrained	TRUSTED_FOR_DELEGATION (userAccountControl 0x80000) on the server's account	Use the TGT each user forwards to it, for any service
Constrained	msDS-AllowedToDelegateTo on the server's account, with TRUSTED_TO_AUTH_FOR_DELEGATION for protocol transition	Get tickets as a user to the listed SPNs only
Resource-based	msDS-AllowedToActOnBehalfOfOtherIdentity on the back end's account	Get tickets as a user to that back end, when it names the server

What Is Logged

Each event below names the log it is written to, the machine that writes it and the audit setting that switches it on, then what to read in it for this page.

Event and Log	Written On	Switch It On	What It Tells You
4769 `A Kerberos service ticket was requested` (opens in a new tab) Security log	Domain controllers	Audit Kerberos Service Ticket Operations	It records the requests a delegating server makes in users' names, and Transited Services lists the services passed through under constrained delegation.TGS Reply: The Service Ticket explains how to read it.
4742 `A computer account was changed` (opens in a new tab) Security log	Domain controllers	Audit Computer Account Management	A computer account's delegation changed, in AllowedToDelegateTo or in the delegation flags of its UAC value.
4738 `A user account was changed` (opens in a new tab) Security log	Domain controllers for domain accounts, the computer itself for local ones	Audit User Account Management	It records the same change on a user account, such as a service account.
5136 `A directory service object was modified` (opens in a new tab) Security log	Domain controllers, for objects with a matching audit entry	Audit Directory Service Changes, and an audit entry (SACL) on the object	It records msDS-AllowedToActOnBehalfOfOtherIdentity being written on a back-end account, where an audit entry covers the attribute.
4624 `An account was successfully logged on` (opens in a new tab) Security log	The computer that was logged on to	Audit Logon	Impersonation Level Delegation means the server may use this logon to reach other machines.Reading Logon Events explains how to read it.

Check It on a Machine

These Windows Registry keys hold the settings this page names. Open one to see where it lives and how to read it on a machine.

Attacks That Hook in Here

These attacks work through what this page describes. Each card says what the attack is and, where it uses one of these steps, what it does there.

Kerberos Delegation Abuse
Uses a server trusted for delegation to reach other services in users' names.
Forced Authentication (Coercion)
Makes a server, a DC included, sign in to a machine the attacker controls.
Pass-the-Ticket
Replays a Kerberos ticket copied from one machine's memory on another.
Diamond and Sapphire Tickets
Alters a real TGT with the krbtgt key, so a genuine sign-in sits behind the forgery.
Delegated Managed Service Account Abuse
A superseded service account hands a new managed account its reach.