Share via

Unconstrained delegation

Anonymous
2024-05-01T17:52:45+00:00

Hi,

Domain controllers are set with unconstrained delegation by design. Can we change it? If so, what should we configure and how?

If not, why not?

Thank you in advance

Windows for business Windows Server Directory services Active Directory

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question. To protect privacy, user profiles for migrated questions are anonymized.

0 comments
Accepted answer
  1. Anonymous
    2024-05-02T01:39:44+00:00

    Hi Lava Bak,

    Thank you for posting in the Microsoft Community Forums.

    If the domain controller is designed with unrestricted delegation, it may pose security risks as it allows unrestricted access to domain resources and permissions. Generally, it is not advisable to maintain unrestricted delegation. If such settings exist on your domain controller, you should take steps to restrict delegation and enhance security as soon as possible.

    You can change unrestricted delegation settings by following these steps:

    1. Check Current Delegation Settings: Firstly, use tools such as Active Directory Users and Computers or Active Directory Administrative Center to check the current delegation settings. Make sure to understand which delegation relationships are unrestricted.
    2. Restrict Delegation Permissions: For each unrestricted delegation relationship, you can take one or more of the following actions:
      • Limit delegation permissions to involve only specific objects or operations.
      • Use the principle of least privilege to ensure that delegation relationships grant only the minimum permissions required by users or groups.
    3. Use Delegation Management Tools: Use delegation management tools in Active Directory to manage and configure delegation permissions. These tools can help you manage delegation relationships more conveniently, ensuring security and compliance.

    Best regards

    Neuvi Jiang

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2024-08-22T10:33:59+00:00

    Hello,

    I am not sure if this is absolutely accurate.

    It seems that the domain controller actually requires unconstrained delegation. If you try to set "do not trust this computer for delegation" on all domain controllers, the flag will clear out by itself on at least one domain controller after a few seconds.

    found this article:

    "Unconstrained delegation is enabled by default and required on all domain controllers (DCs)"

    Unconstrained delegation: Too trusting for its own good

    0 comments