Constrained delegation is a Kerberos delegation setting in Active Directory that allows a service to impersonate users only to specific downstream services. It was introduced as a safer alternative to unconstrained delegation because it limits where delegated authentication can be used. The simplest way to think about constrained delegation is: A service can act on […]
Constrained Delegation in Active Directory Read Post »
Unconstrained delegation is a legacy Kerberos delegation setting in Active Directory that allows a trusted service to impersonate users to other services. It was designed to support multi-tier applications, but it can create serious security risk if the trusted server or service account is compromised. A server trusted for unconstrained delegation may be able to
Unconstrained Delegation in Active Directory Read Post »
Kerberoasting is an Active Directory attack technique where an authenticated domain user requests Kerberos service tickets for accounts that have Service Principal Names, then attempts to crack those tickets offline to recover the service account passwords. Kerberoasting is dangerous because it does not require administrative privileges. In many environments, any valid domain user can request
Kerberoasting in Active Directory Read Post »
LDAP signing is a security control that helps protect communication between LDAP clients and Active Directory domain controllers. It helps ensure that LDAP traffic has not been tampered with in transit and reduces exposure to certain man-in-the-middle and relay-style attacks. In many Active Directory environments, LDAP is used constantly. Applications, servers, workstations, network appliances, and
LDAP Signing and Why It Matters Read Post »