Kerberos Constrained Delegation (S4U2Proxy)

Abuse an Active Directory user account configured for Kerberos constrained delegation to request an S4U2Self ticket and then an S4U2Proxy service ticket for an SPN in that account's msDS-AllowedToDelegateTo list. In this user-account example, Rubeus authenticates with the account key and /ptt imports the resulting service ticket into the current Windows logon session. Protocol transition must be enabled for a forwardable S4U2Self ticket, and access to the target service still depends on the impersonated user's authorization.