This article guides professionals on how to ban delegation of privileged accounts for an Active Directory Domain.
Implementing this control should be considered at a minimum as high importance.
PS. G5 Cyber Security can scan your entire network for security vulnerabilities, guide you to resolve them, and more. Please contact us here to get started.
Why you should implement this security control
Privileged accounts such as those belonging to any of the administrator groups must not be trusted for delegation. Allowing privileged accounts to be trusted for delegation provides a means for privilege escalation from a compromised system.
How to implement this security control
- Open Active Directory Users and Computers. View the properties of all privileged accounts.
- Under the Account tab, select "Account is sensitive and cannot be delegated" in the Account Options section.
How to verify this security control is implemented
- Review the properties of all privileged accounts in Active Directory Users and Computers.
- Under the Account tab, verify "Account is sensitive and cannot be delegated" is selected in the Account Options section. If delegation is not prohibited for any privileged account, this is an issue.