> For the complete documentation index, see [llms.txt](https://wiki.securiters.com/securiters-wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.securiters.com/securiters-wiki/internas/ad/persistence_kerberos-and-tickets.md).

# PE - Delegations

> Resources: <https://stealthbits.com/blog/constrained-delegation-abuse-abusing-constrained-delegation-to-achieve-elevated-access/>

Cuando se establece la delegación Constrained en una cuenta, ocurren dos cosas:&#x20;

1\. El atributo userAccountControl del objeto se actualiza con la flag "TRUSTED\_TO\_AUTHENTICATE\_FOR\_DELEGATION".&#x20;

2\. El atributo msDS-AllowedToDelegateTo se rellena con el SPN configurado en la pestaña de delegation.

> Resources: <https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/unconstrained-delegation>