Ariovis

Active Directory attack paths · Kerberos delegation

Resource-Based Constrained Delegation (RBCD): securing Kerberos delegation in Active Directory

Resource-Based Constrained Delegation (RBCD) is a Kerberos delegation mechanism in Active Directory. It allows a service to act on behalf of a user when accessing a target service, but the resource's account determines which principals are permitted to delegate. This control is stored in the "msDS-AllowedToActOnBehalfOfOtherIdentity" attribute.

Unlike traditional constrained delegation, where the permitted target services are configured on the delegating account, RBCD attaches the delegation decision to the target resource. This is useful for service administration, but it makes write permissions on Active Directory computer objects particularly sensitive.

Understand Active Directory attack paths

Why can RBCD create an attack path?

The risk does not come from the mechanism alone. It arises when an identity has excessive permissions over a server object, when an unexpected principal is allowed to delegate, or when the target resource is critical. By combining these permissions with Kerberos delegation capabilities, an attacker who already has a foothold in the environment may attempt to access a service under another user's identity. The impact depends on that user's privileges and the resource involved.

The analysis must therefore cover the complete path: who can modify the target object, which principals are allowed to delegate, and which sensitive resources become reachable? An isolated permission is not enough to assess the risk; the relationships between objects, ACLs and privileged identities make the difference.

Visualising the attack path

Every step is conditional. The mere existence of RBCD, a write permission or an authorised principal is not evidence of compromise.

  1. 01

    Conditional step

    Compromised identity

    An attacker initially has an identity in the environment.

  2. 02

    Conditional step

    Permission on the target object

    This identity directly or indirectly holds permissions allowing it to modify the resource’s RBCD configuration.

  3. 03

    Conditional step

    RBCD relationship modified

    An attacker-controlled principal meeting the necessary Kerberos prerequisites is authorised on the target object.

  4. 04

    Conditional step

    Kerberos delegation

    The S4U2Proxy mechanism may allow a service ticket to be obtained on behalf of a user, subject to the applicable conditions and protections.

  5. 05

    Conditional step

    Access to the target service

    The service processes access according to the represented identity and the controls actually applied.

  6. 06

    Conditional step

    Potential impact

    Depending on the privileges involved and the reachable resources, the path may lead to a critical resource, or even Tier 0.

Technical facts

Mechanism
Resource-Based Constrained Delegation
Protocol
Kerberos, S4U extensions
Main attribute
"msDS-AllowedToActOnBehalfOfOtherIdentity"
Attribute type
NT security descriptor, not a simple list of SPNs
Decisive resource
Active Directory object holding the delegation configuration
Risk factor
Effective permissions allowing this relationship to be modified
Monitoring signal
Attribute changes, notably through event 5136 if auditing is configured
ANSSI recommendation
R65 — Address the risks inherent in Kerberos delegation

How can the risk be reduced?

Strictly limit permissions to modify Active Directory objects and RBCD configurations. Regularly review authorized principals and remove delegations that are no longer needed. Avoid delegations that create paths towards Tier 0 resources from less trusted zones. ANSSI specifically recommends prohibiting resource-based constrained delegation configured on Tier 0 services from other trust zones. Kerberos delegation must also be disabled for Tier 0 administrative accounts and, wherever possible, for Tier 1 and Tier 2 administrative accounts.

ANSSI — R65: Address the risks inherent in Kerberos delegation (pp. 91–92)

Detection and logging

For detection, monitor unexpected changes to "msDS-AllowedToActOnBehalfOfOtherIdentity", especially those initiated by machine accounts, and correlate them with Kerberos activity involving the target resource. In the context of KrbRelayUp, Microsoft Defender for Identity documents suspicious RBCD attribute modifications by machine accounts and suspicious delegation attempts involving newly created computers. These detections do not cover every possible RBCD abuse scenario.

Event 5136: logging prerequisites

Monitoring an attribute change requires its logging to be configured. Windows event 5136 allows certain changes to Active Directory objects to be observed, provided the Audit Directory Service Changes subcategory and the relevant SACLs are configured. The account responsible for the change, the resource involved and Kerberos events must then be correlated to assess the risk.

RBCD illustrates a central principle of Active Directory security: delegation must be justified, limited to a specific need and continuously monitored. Mapping permissions on directory objects and prioritizing those that create paths towards Tier 0 allows organizations to address the underlying causes rather than treating individual events separately.

Related techniques

Technical sources

Do your Kerberos delegations open a path towards Tier 0?

An analysis of ACLs, service accounts and delegation relationships identifies genuinely exploitable paths and helps prioritise corrections.

Analyse delegations and attack paths in your Active Directory

Secure my Active Directory identities