Unconstrained Delegation via EFSRPC Coercion

On an Active Directory domain where an operator already controls a host configured for unconstrained Kerberos delegation, identify that receiver and start ticket monitoring before coercing a selected target through MS-EFSRPC (for example, PetitPotam). If the target authenticates to the receiver with a delegable Kerberos credential and the receiver's protections permit it, Windows can cache a forwarded TGT in LSASS for an elevated operator to capture with Rubeus or export with Mimikatz. This requires an accessible EFSRPC endpoint, target-to-receiver SMB reachability, a delegation-eligible account, and elevated access to the receiver. An NTLM-only callback does not produce the Kerberos TGT described here; using the ticket is a separate action.