Test the delegation path. Resolve the risk.

Explore how Unconstrained Delegation, S4U2Self protocol transition, and Resource-Based Constrained Delegation (RBCD) compromise Tier-0 Active Directory assets. 100% browser-local evaluation.

Interactive policy

Kerberos configuration

Delegation verdict

DOMAIN_TAKEOVER

Full Domain Compromise via TGT Extraction

T1558.003 / Kerberoasting & Delegation Abuse

The computer account has 'TRUSTED_FOR_DELEGATION' enabled. When any user (including a Domain Admin) connects, their complete Ticket Granting Ticket (TGT) is stored unencrypted in LSASS memory on this host.

Execution path

Attacker compromises the host with unconstrained delegation.
Coerce Tier-0 authentication (e.g. PetitPotam / PrinterBug) or wait for administrator connection.
Extract TGT from memory via Mimikatz (sekurlsa::tickets) or Rubeus (dump).
Pass-the-Ticket to any service on the Domain Controller.

Defensible remediation

Audit and eliminate unconstrained delegation on all member servers and non-DC computers.
Enable Kerberos armor (FAST) and restrict RPC spooler endpoints.

Operator audit command

Rubeus.exe dump /service:krbtgt /nowrap

Test the delegation path. Resolve the risk.

Kerberos configuration

Preset attack path