Unconstrained Delegation

Abuse of an Active Directory computer or service identity configured for unconstrained Kerberos delegation. After obtaining control of a delegated host, an operator may cause an eligible target to authenticate to it and retrieve the forwarded TGT from that host's ticket cache. Protected Users and accounts marked as sensitive and nondelegable do not delegate their TGTs; coercion, trust, and protocol conditions also affect whether a ticket is forwarded. A captured TGT provides only the permissions of its principal and does not by itself prove access to a particular service.