Ensure privileged accounts are not delegated - Recommendation

Question

Hi,

There is a recommendation MS Defender portal about 'Ensure privileged accounts are not delegated'. The list contains all our Domain Controllers, ADFS, Print Servers and 1 MSOL_Account. My questions is, is it safe to enable these? Or I should not enable it? Thank you!

Answer 1

@Champ

Thank you for posting this in Microsoft Q&A.

As I understand you are getting Microsoft defender recommendation as "Ensure privileged accounts are not delegated". You want to know if you can enable the same of you can ignore it.

Usually, If the sensitive flag is disabled, attackers could exploit Kerberos delegation to misuse privileged account credentials, leading to unauthorized access, lateral movement, and potential network-wide security breaches. Setting the sensitive flag on privileged user accounts prevent users from gaining access to the account and manipulating system settings. For device accounts, setting them to "not delegated" is important to prevent it from being used in any delegation scenario, ensuring that credentials on this machine can't be forwarded to access other services.

I would suggest you get this property set for these accounts to keep your environment safe.

To Remediate this, you can follow below steps,

1. Review the list of exposed entities to discover which of your privileged accounts don’t have the configuration flag "this account is sensitive and cannot be delegated."
2. Take appropriate action on those accounts:

• For user accounts: by setting the account's control flags to "this account is sensitive and cannot be delegated." Under the Account tab, select the check box to this flag in the Account Options section. This prevents users from gaining access to the account and manipulating system settings.  

• For device accounts: The safest approach is to use a PowerShell script to configure the device to prevent it from being used in any delegation scenario, ensuring that credentials on this machine can't be forwarded to access other services.

$name = "ComputerA"

Get-ADComputer -Identity $name |

Set-ADAccountControl -AccountNotDelegated:$true

Another option is to set the UserAccountControl attribute to NOT_DELEGATED = 0x100000 under the Attribute Editor tab for the exposed device.

For example:

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.