Disable unconstrained delegation for Kerberos –

To disable unconstrained delegation in Active Directory, find every account that has it, then switch each one to “not trusted” or to constrained delegation. Domain controllers are the exception: they need unconstrained delegation to work, so leave them alone.

1. Find accounts with unconstrained delegation

powershell

Import-Module ActiveDirectory

# Computers (excluding domain controllers)
Get-ADComputer -Filter {TrustedForDelegation -eq $true -and PrimaryGroupID -ne 516} -Properties TrustedForDelegation |
    Select-Object Name, DistinguishedName

# Users / service accounts
Get-ADUser -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation, ServicePrincipalName |
    Select-Object SamAccountName, ServicePrincipalName

You can also run the raw LDAP query for the TRUSTED_FOR_DELEGATION flag (524288):

powershell

Get-ADObject -LDAPFilter "(userAccountControl:1.2.840.113556.1.4.803:=524288)"

2. Remove the delegation flag

powershell

# Single account
Set-ADAccountControl -Identity "SERVER01$" -TrustedForDelegation $false

# All non-DC computers found above
Get-ADComputer -Filter {TrustedForDelegation -eq $true -and PrimaryGroupID -ne 516} |
    Set-ADAccountControl -TrustedForDelegation $false

To do it in the GUI, open Active Directory Users and Computers, then the account’s Properties, then the Delegation tab. Choose “Do not trust this computer for delegation”. If a service genuinely needs delegation, choose “Trust this computer for delegation to specified services only” instead.

3. Replace it where something needs delegation

Some apps rely on delegation, such as IIS or SQL “double-hop” setups. Before you flip the flag on those, give them one of these instead:

• Constrained delegation: set the allowed services in msDS-AllowedToDelegateTo, or use the GUI option above.
• Resource-based constrained delegation:

powershell

  Set-ADComputer BackendSrv -PrincipalsAllowedToDelegateToAccount (Get-ADComputer FrontendSrv)

4. Harden privileged accounts

powershell

# Mark admin accounts as "sensitive and cannot be delegated"
Set-ADUser -Identity "admin.jdoe" -AccountNotDelegated $true

Also add privileged users to the Protected Users group, which blocks delegation of their credentials entirely.

5. Restrict who can enable delegation again

In the Default Domain Controllers Policy, go to Computer Configuration > Windows Settings > Security Settings > User Rights Assignment. Set “Enable computer and user accounts to be trusted for delegation” to Administrators only, or leave it empty.

6. Cross-forest trusts (if applicable)

Make sure TGT delegation across trusts is off. This is the default since the July 2019 updates.

cmd

netdom trust <TrustingDomain> /domain:<TrustedDomain> /EnableTGTDelegation:No

Change one account at a time where you can, and watch for authentication failures, such as Kerberos errors in the System and Security event logs on app servers. Failures after the change usually mean a service relied on delegation and needs constrained or resource-based delegation set up.