Active Directory Delegation Scanner

This PowerShell script audits Active Directory for Kerberos delegation configurations (unconstrained, constrained, and resource-based) and exports the results to a CSV file.

Purpose

Kerberos delegation lets a service impersonate users to other services. Misconfigured delegation is one of the most common paths to full domain compromise, so every delegated account should be known and justified.

The script reports three categories:

Type	Detected by	Risk
Unconstrained	userAccountControl bit 0x80000 (524288)	Highest. A compromise of the host captures TGTs of anyone who authenticates to it. Domain Controllers legitimately have this and are flagged IsDC = True.
Constrained	msDS-AllowedToDelegateTo is set	Limited to specific target services. "Protocol transition" (any auth protocol) is called out separately as higher risk.
Resource-based (RBCD)	msDS-AllowedToActOnBehalfOfOtherIdentity is set	The principals allowed to delegate to the object are parsed from the security descriptor and listed.

Key Features

• Uses only built-in System.DirectoryServices classes, with no ActiveDirectory module required.
• Runs without admin privileges; only read access to AD is needed.
• Covers users and computers across all three delegation types in one run.
• Resolves RBCD principals from the raw security descriptor to account names.
• Flags Domain Controllers so expected unconstrained delegation can be filtered out.
• Paged LDAP queries (1000/page), suitable for large domains.

How It Works

1. Binds to RootDSE to discover the default naming context (or uses -SearchBase).
2. Runs three LDAP searches:
   • (userAccountControl:1.2.840.113556.1.4.803:=524288) for unconstrained
   • (msDS-AllowedToDelegateTo=*) for constrained
   • (msDS-AllowedToActOnBehalfOfOtherIdentity=*) for RBCD
3. Classifies each object, resolves RBCD principals, and marks DCs.
4. Exports the merged results and prints a summary.

Usage

.\ADDelegation.ps1
.\ADDelegation.ps1 -Server dc01.example.com -OutputPath C:\Audit\delegation.csv
.\ADDelegation.ps1 -IncludeDisabled

Parameter	Description
-Server	Domain controller to query directly (dc01.example.com or :636).
-SearchBase	Distinguished name to scope the search.
-OutputPath	CSV output path. Defaults to .\ad_delegation_<domain>.csv.
-IncludeDisabled	Include disabled accounts (excluded by default).

CSV Columns

Name, SamAccountName, ObjectType, Enabled, DelegationType, IsDC, Targets, DistinguishedName.

Requirements

• PowerShell 5.1 or higher
• Domain connectivity (domain-joined or reachable DC via -Server)
• Read access to Active Directory

Security Implications

• Eliminate unconstrained delegation on anything that is not a Domain Controller. Migrate to constrained or resource-based delegation.
• Add sensitive accounts to the Protected Users group and/or mark them "Account is sensitive and cannot be delegated" so they can never be delegated.
• Review constrained-with-protocol-transition accounts closely, because they can obtain tickets for users who never authenticated to them.
• Audit RBCD writers: whoever can write msDS-AllowedToActOnBehalfOfOtherIdentity on an object can set up a delegation attack against it.