Constrained delegation gives service administrators the ability to specify and enforce application trust boundaries by limiting the scope where application services can act on a user’s behalf. Service administrators can configure which front-end service accounts can delegate to their back-end services.
How do you enable constrained delegation?
Configure S4U2self (Protocol Transition) constrained delegation on the computer account. To do this, right-click the computer account, and then select Properties > Delegation > Trust this computer for delegation to specified services only. Select Use any authentication protocol.
What is unconstrained delegation?
Unconstrained delegation is a privilege that domain administrators can assign to a domain computer or a user. Caching the TGT allows the system to verify that the user has already authenticated without requesting re-authentication and can impersonate the authenticated user to access any other services.
Do domain controllers require unconstrained delegation?
One thing to note is that Domain Controllers, by default, are configured with unconstrained delegation. This is required, and since your Domain Controllers should be much more secure than a random application server hosting a service, it should not be a problem.
What is Resource delegation?
Resource-based constrained delegation allows resources to configure which accounts are trusted to delegate to them. The attacker additionally compromises an account with the rights to configure resource-based constrained delegation for the computer account of the target host (“Service B”).
How does unconstrained delegation work?
Any domain computers with unconstrained delegation enabled can impersonate user credentials to any service in the domain. Unconstrained delegation is a privilege that domain administrators can assign to a domain computer or a user. They can enable it from the Delegation tab settings within the object properties.
Why do domain controllers have unconstrained delegation?
