Impacket's rbcd.py reads and changes the msDS-AllowedToActOnBehalfOfOtherIdentity security descriptor on a target Active Directory account, commonly a computer account for a service. Its read, write, remove, and flush actions manage resource-based constrained delegation. A write can authorize a named delegate account to act on behalf of other identities through S4U2Proxy, subject to Active Directory access checks and Kerberos conditions; the write configures delegation but does not itself request a service ticket.
Python
RESTRICTED_ACCESS_BLUR_MARKER