Kerberos Delegation Persistence / Misconfiguration Response (RBCD / Constrained)
When a DR-DELEG-3/4/5/6/7 alert indicates delegation persistence or misconfiguration and there is no evidence of active exploitation, reverts unauthorized RBCD/constrained/unconstrained delegation changes, closes the persistence path, and does not touch krbtgt.
Prepare
7 steps- Keep delegation inventory current
Verify that the "DS Access > Audit Directory Service Changes" policy is active on DCs; without EID 5136, RBCD and constrained delegation changes cannot be detected.
- Unconstrained delegation inventory
Document all objects carrying the flag outside of DCs using `Get-ADComputer -Filter {TrustedForDelegation -eq $true}` and `Get-ADUser -Filter {TrustedForDelegation -eq $true}`.
- Constrained delegation inventory
Record the approved SPN lists using `Get-ADComputer -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo,TrustedToAuthForDelegation`.
- RBCD inventory
Store the output of `Get-ADComputer -Filter * -Properties msDS-AllowedToActOnBehalfOfOtherIdentity | Where-Object { $_.msDS-AllowedToActOnBehalfOfOtherIdentity -ne $null }` as a baseline.
- MachineAccountQuota check
Verify the value with `Get-ADObject (Get-ADDomain).DistinguishedName -Properties ms-DS-MachineAccountQuota`; expected: 0; if the default is 10, add remediation to the backlog.
- Define the escalation chain