Detecting use of active directory delegation

Copper Contributor

Hi All!

 

I am currently trying to investigate how certain delegations (and unconstrained delegations) are used in our active directory enviroment. Since the system owners can't explain where its delegating to, i cannot remediate this without knowing how to set this up properly, to not harm the production enviroments. 

 

My initial thought was to use advanced hunting query to see where accounts are delegating logins to, but i'm not sure this information is actually available in advanced huting.

 

Do any of you have any experience investigating this via advanced hunting, or am i looking down the wrong street?
Any help is appreciated. 

0 Replies