RBCD via NTLM Relay

NTLM relay to an LDAPS directory endpoint can be used to modify a computer object's resource-based constrained delegation (RBCD) access control data. When an account authorized by that RBCD configuration requests a service ticket through S4U2Proxy, the KDC issues a service ticket for the selected user to a service on that computer; the resulting access is limited by the service and target's authorization. This does not itself create a forged Kerberos ticket or grant unrestricted administrative access. The current examples also include a downstream SAM-access action, which is not inherent to RBCD configuration.