Posture check · Delegation and Kerberos
Other accounts can act on this object's behalf (resource-based constrained delegation)
This object lists other accounts that may request access to its services on behalf of any user. The setting is resource-based constrained delegation (RBCD).
Why it matters
If any listed account is less protected than this object, control of that account becomes a route to this object. On a Tier 0 system that route leads to the domain.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Active Directory.
It reads:
- The directory attributes
msDS-AllowedToActOnBehalfOfOtherIdentity,userAccountControl,accountEnabledandobjectSid - The privilege tier classification
Tiered Fidelity™ level: Constrained
Every finding from this check carries the Constrained level.
- TheoreticalConfigured in the directory. Nothing else checked.
- ConstrainedThis checkA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
How Select Fire™ fixes it
How to fix it
Remove every account that should not act on this object's behalf. If nothing should, clear the setting.
What Select Fire changes
Select Fire opens from the finding and simulates each change on your live graph before anything changes in your directory.
- Remove an account allowed to act on this objectSemi-Auto: you authorize each change. Full-Auto never runs it.
The removed account can no longer reach this object's services on behalf of users. An application that relied on it will fail to authenticate users to this object.
- Clear resource-based delegationManual: you approve each change one at a time, and no automation runs it.
No account can reach this object's services on behalf of users any more. Applications that relied on it will fail to authenticate users to this object.
By hand: In the object's properties, remove every account listed under resource-based delegation that should not be there. If none should, clear the attribute.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.