What happens when unconstrained delegation is enabled on a server that an attacker can control?

The server becomes a high value credential cache. An attacker can extract service tickets or a user’s TGT from memory, then impersonate that user to other systems in the domain. That turns one compromised host into a broader trust abuse path, which can expand access well beyond the original server and hide malicious activity behind a legitimate identity.

Why Unconstrained Delegation Becomes Dangerous on a Compromised Server

unconstrained delegation turns the server into a trust amplifier. When that host is controlled by an attacker, the danger is not only local compromise; it is the ability to capture inbound Kerberos material and reuse a victim’s identity against other systems that trust it. In practice, that creates a domain-wide impersonation problem rather than a single-host incident.

The security issue is that unconstrained delegation assumes the server is safe to receive and retain delegated credentials. Once that assumption fails, the attacker inherits whatever the server can see in memory and can pivot through legitimate authentication paths instead of noisy password theft. That is why this configuration is often treated as a high-risk exception rather than a routine default. The general attack pattern maps closely to known credential-access and trust-abuse behaviour described in the MITRE ATT&CK Enterprise Matrix.

In practice, many security teams discover the real blast radius only after a privileged session has already been replayed through a trusted host.

How the Abuse Chain Works in Practice

Kerberos delegation exists so one service can act on behalf of a user to reach downstream resources. With unconstrained delegation, the server is not restricted to a narrow target set, so the attacker does not need to guess which backend will be reachable. They only need control of the delegated host, then patience to wait for useful authentication traffic.

Once a user or service authenticates to that server, tickets may be exposed in memory in a form the attacker can extract. From there, the attacker can request access to other domain services as the delegated identity, often without needing to crack a password. That is what makes the issue more serious than ordinary server compromise: the attacker is exploiting a trust relationship, not just a vulnerable process. A useful primer on the broader NHI and credential-abuse pattern is NHIMG’s Ultimate Guide to NHIs — Key Challenges and Risks, which frames why reusable authentication material becomes a persistence asset once a host is exposed.

The attacker controls the delegated server and waits for privileged users or services to connect.
Kerberos material in memory becomes a reuse target, especially for high-value accounts.
The attacker impersonates the delegated identity to reach file shares, management interfaces, or domain services.
Activity can blend into normal access patterns because the requests come from a legitimate identity and a trusted path.

This breaks down fastest in environments where privileged users routinely authenticate to tiered servers, because one exposed delegation point can expose multiple downstream trust paths at once.

Common Variations and Edge Cases

Tighter delegation controls often reduce operational convenience, so organisations have to balance application compatibility against credential exposure. That tradeoff is especially visible in older enterprise applications that were built around broad trust assumptions and now resist least-privilege redesign.

Not every delegated server is equally dangerous. The practical risk depends on who authenticates to it, what downstream systems trust it, and whether high-value accounts ever land there. A low-privilege application server may still be a problem, but a server that receives administrator, backup, or service credentials is materially more dangerous. Current guidance increasingly favours constrained delegation or other scoped trust designs, but there is no universal standard for every legacy workload shape.

Another edge case is detection. Because the attacker can operate through legitimate Kerberos flows, alerts that focus only on password spraying or obvious lateral movement may miss the abuse. Teams should therefore treat unusual delegation use, unexpected service-ticket behaviour, and privileged logon paths as a control validation problem, not just an incident-response problem. NHIMG’s The 52 NHI Breaches Report is useful here because it shows how compromised trusted identities tend to expand impact after the initial foothold.

Risk and Threat Considerations

Unconstrained delegation creates a credential exposure risk because the server is effectively trusted to hold reusable authentication material for other systems. If an attacker controls that host, the trust model collapses into identity impersonation and lateral movement potential across the domain.

Failure mechanism: the attacker abuses delegated Kerberos material in memory, then reuses the victim’s identity to access additional services without needing the original password. This is a recognised trust-abuse path that turns one compromised server into a credential relay point.

Impact: downstream systems may accept the attacker as the delegated user, which can expose data, administrative functions, and broader domain resources while reducing the visibility normally associated with direct password compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1558.003 — Kerberos Delegation	Unconstrained delegation abuse is a Kerberos delegation trust abuse pattern.
Recommendation — Hunt for delegated-ticket abuse and restrict Kerberos delegation paths to limit impersonation.
CIS Controls v8	6.3 — Privileged Account Management	Compromised delegation hosts amplify privileged account exposure and reuse.
Recommendation — Restrict privileged logons to delegated servers and remove unnecessary admin access paths.
NIST CSF 2.0	PR.AC-4 — Access Permissions and Authorizations Are Managed	Delegation is an authorization boundary that must be tightly managed and reviewed.
Recommendation — Review and limit delegation permissions to prevent excessive trust relationships.
NIST Zero Trust (SP 800-207)	SC-7 — Resource Access Policy Enforcement	A trusted server should not be able to broadly relay identity without policy scoping.
Recommendation — Enforce scoped, policy-driven access so one compromised host cannot relay broad trust.
OWASP Non-Human Identity Top 10	NHI-03 — NHI Access Scope and Privilege	Delegated machine or service identities can inherit excessive usable access from the host.
Recommendation — Minimise delegated identity scope and remove broad host-level trust wherever possible.

Practitioner Guidance

What to prioritise: Treat any server with unconstrained delegation as a high-priority trust boundary review item. The first question is not whether the host is patched; it is whether any privileged or high-value account can authenticate to it in the first place.

What to verify: Confirm which accounts, services, and applications can land on the server, then check whether those identities can reach higher-tier systems from there. If the answer is yes, the environment already has a privilege-amplification path and should be scoped for redesign or containment.

Decision rule: If the delegated host is reachable by administrator, service, or backup identities, treat the configuration as an urgent exposure even if no abuse is detected. If the host is low value and tightly isolated, the issue is still real, but the blast radius is narrower and the remediation sequence can be more controlled.

Practitioner takeaway: The key judgement is to measure delegated-host trust by the identities it can receive, not by the server’s apparent business function; that is where hidden domain-wide exposure usually lives.