Posture check · Delegation and Kerberos
Delegation with protocol transition enabled (T1558, T1550.003)
This account may obtain access to its delegation targets on behalf of a user without that user authenticating with Kerberos. The setting is protocol transition.
Why it matters
Control of this account is enough to reach its delegation targets as any user. When a target is a domain controller or other Tier 0 system, that is control of the domain.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Active Directory.
It reads:
- The directory attributes
userAccountControl,accountEnabled,msDS-AllowedToDelegateTo,dNSHostName,servicePrincipalName,sAMAccountNameandobjectSid - The privilege tier classification
Tiered Fidelity™ level: Theoretical
Every finding from this check carries the Theoretical level.
- TheoreticalThis checkConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
How Select Fire™ fixes it
How to fix it
Clear the protocol transition setting unless an application requires it, and remove any delegation target that points at a Tier 0 system.
What Select Fire changes
Select Fire opens from the finding and simulates each change on your live graph before anything changes in your directory.
- Clear protocol transitionSemi-Auto: you authorize each change. Full-Auto never runs it.
Applications that authenticate users without Kerberos and then reach back-end services as those users will stop working. Changing this setting needs an account allowed to enable delegation.
By hand: Change the account's delegation setting from 'Use any authentication protocol' to 'Use Kerberos only', unless an application requires it.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.