AD Starter Scan - Unconstrained delegation

high Nessus Plugin ID 150485


Dangerous Kerberos delegation set.


Kerberos, the protocol at the core of Active Directory security, allows certain servers to obtain a user's credentials and use those to authenticate on behalf of the user.

When a user authenticates on a server that is Trusted for delegation, a copy of the user's credentials is sent to the server by the domain controller. These credentials can then be used to authenticate on behalf of the user.

If an attacker is able to compromise such a server, they will be able to steal and reuse the credentials of all the users authenticating on this particular server. If an administrator connects to the compromised machine, the attacker will be able to escalate their privileges and become an administrator as well. As a consequence, the Trusted for delegation property should only be allowed on trusted servers such as domain controllers. This mechanism is called unconstrained delegation.

Note: This plugin is part of the Active Directory Starter Scan Template and is meant to be used for preliminary analysis of AD hosts. For more information on the issues discovered by the Active Directory Starter Scan plugins, please refer to this blog post -


The only accounts using unconstrained delegation should be the domain controller accounts. Administrators should also be protected against any dangerous delegation type:
- by being members of the 'Protected Users' group, or
- by setting the 'Account is sensitive and cannot be delegated' flag on the user accounts

See Also

Plugin Details

Severity: High

ID: 150485

File Name: adsi_kerberos_deleg.nbin

Version: 1.75

Type: local

Agent: windows

Family: Windows

Published: 7/29/2021

Updated: 9/25/2023

Supported Sensors: Nessus Agent

Risk Information

CVSS Score Rationale: Score based on an in-depth analysis by tenable.


Risk Factor: High

Base Score: 7.4

Vector: CVSS2#AV:A/AC:M/Au:S/C:C/I:C/A:C

CVSS Score Source: manual


Risk Factor: High

Base Score: 7.1

Vector: CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:microsoft:active_directory

Required KB Items: ldap_enum_computer/available