How Unconstrained Delegation Can Enable Active Directory Domain Takeover

Summary

A lab walkthrough demonstrates using Mythic C2 and unconstrained delegation to capture a domain controller ticket, perform DCSync, and revoke the risky delegation setting.

Key points

• The demonstration uses a lab domain with an accessible machine configured for unconstrained delegation.
• The presenter explains how incoming authentication can expose tickets and how coercion can trigger a domain controller to authenticate to the delegated machine.
• The walkthrough uses Mythic C2, reconnaissance, and a ticket-monitoring tool to obtain a domain controller ticket.
• The presenter demonstrates importing the ticket and using DCSync to retrieve an administrative user's hash.
• The video warns against pasting authentication tickets into AI services because they may reveal details about the environment.
• A PowerShell script is shown that can enable or revoke unconstrained delegation for a specified computer; the presenter recommends revoking it to patch a system.

MITRE ATT&CK

Products

Tools

Related Articles

• CYFIRMA Report Finds Rising Ransomware and APT Activity Targeting Real Estate and Constructioncyfirma.comMicrosoft Active Directory · Microsoft Windows · PowerShell
• DomainTools Links Homeland Justice, Karma and Handala to an MOIS-Aligned Cyber Campaigndti.domaintools.comMicrosoft Active Directory · Microsoft Windows · PowerShell
• How to Evict an Attacker from Active Directory After Detectionhuntress.comMicrosoft Active Directory · Microsoft Windows · PowerShell
• Sopra Steria’s 2026 Security Report Highlights Identity Threats and Nordic Infrastructure Risksgithub.com/jacobdjwilsonMicrosoft Active Directory · Microsoft Windows · T1550.003
• Chinese Government-Linked Actors Combine Automated and Hands-On Hacking to Steal Sensitive Datacisa.govMicrosoft Active Directory · Microsoft Windows · T1003.006