> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/infrastructure/active-directory/delegation-abuse/constrained-delegation.md).

# Constrained Delegation

Constrained delegation is a safer way to perform Kerberos delegation. In contrast to unconstrained delegation, constrained delegation restricts the services to which the server an act on behalf of a user. This means that the server can be configured to only present delegated credentials to the database server, instead of any other arbitrary service.

### Enumerating Constrained Delegation

```bash
# Enumerating with PowerView
Get-DomainComputer -TrustedToAuth -Properties DnsHostName, MSDS-AllowedToDelegateTo

# Enumerating with BloodHound
MATCH (c:Computer), (t:Computer), p=((c)-[:AllowedToDelegate]->(t)) RETURN p
```

### Notes

* When enumerating constrained delegation, enumerating the service type is extremely important. For exampke, enumerating `cifs` means that we are able to execute PsExec against the host as well as upload and/or download files. 

### References

{% embed url="<https://sensepost.com/blog/2022/constrained-delegation-considerations-for-lateral-movement/>" %}

{% embed url="<http://blog.redxorblue.com/2019/12/no-shells-required-using-impacket-to.html>" %}