Abuse Resource-Based Constrained Delegation (RBCD)

Abuse Resource-Based Constrained Delegation (RBCD) when an operator controls an SPN-bearing service account and can write the target account's msDS-AllowedToActOnBehalfOfOtherIdentity attribute. Add that service account to the target's delegation security descriptor, then use S4U2Self and S4U2Proxy to obtain a KDC-issued service ticket for a selected user to a target SPN and, if appropriate, import that ticket into the current logon session. A newly created computer account can provide the delegating account when domain policy or delegated rights allow; an existing controlled SPN account can also be used. The ticket provides only the selected user's existing access to the requested service.