Read as
Last updated: April 29, 2026
Unconstrained, constrained, RBCD. S4U2Self + S4U2Proxy, MachineAccountQuota, PetitPotam coercion.
Kerberos delegation lets a service act on behalf of a user when talking to another service. Web frontend authenticates user; web frontend needs to query backend DB as that user; delegation lets this work without the user directly authenticating to the DB. It’s a useful feature. It’s also one of the most abused paths to Domain Admin in modern engagements.
The three delegation types
- Unconstrained: service can act as user for ANY other service. Attacker who compromises an unconstrained-delegation server gets TGT of every user who authenticates to it.
- Constrained: service can act as user for SPECIFIC other services. Abuse via S4U2Self + S4U2Proxy chain.
- Resource-Based Constrained Delegation (RBCD): introduced 2012. Target resource specifies which accounts can delegate to it. Changed the attack surface significantly.
Want this for your team?
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.
Book team training call
Replies in 4 working hrs · India-only · Senior consultants