S4U2Self Abuse

S4U2Self (Service for User to Self) lets a service use its own Kerberos context to ask the KDC for a service ticket to itself on behalf of a specified user, without that user's password. Abuse requires control of a service or computer account with a registered SPN and a usable TGT. A forwardable S4U2Self ticket may be used with separately configured constrained delegation (S4U2Proxy) to request a ticket for an allowed backend service; the self ticket alone is not a TGT and does not grant arbitrary share access or command execution. Actual access depends on the target service and the impersonated user's rights.