Getting authentication delegation settings for an AD account from a non Domain controller with Powershell

Question

I have admin rights on a machine connected to AD. But I don't have rights on the Domain Controller.

With PowerShell is it possible to get all authentication delegation settings of an AD account from my admin machine? If possible how?

What I mean as delegation settings is the Delegation tab of the AD account, used for Kerberos authentication. Below is a snapshot of what I am referring about. Currently I could see few services to which the account can present delegated credentials, but not all since I cannot scroll down the list as it is greyed out.

Do you have the Active Directory Module for Windows PowerShell installed? — T-Heron, Jan 17 '17 at 12:33
@T-Heron : Yes I have the ActiveDirectory module imported in my PS session. — Baskar Lingam Ramachandran, Jan 17 '17 at 13:36

score 1 · Answer 1 · answered Jun 14 '17 at 16:57

1

Get-ADObject -Filter {name -eq "yoursamaccountname"} -Properties msDS-AllowedToDelegateTo

answered Jun 14 '17 at 16:57

Neroon

1,341
1
9
4

I get the warning : PS F:\Documents> Import-Module ActiveDirectory WARNING: Error initializing default drive: 'Unable to contact the server. This may be because this server does not exist, it is currently down, or it does not have the Active Directory Web Services running.'. – Baskar Lingam Ramachandran Jul 21 '17 at 10:49

score 1 · Answer 2 · answered Sep 30 '21 at 08:16

1

Get-ADUser -Filter {SamAccountName -eq "YourAccountSamName"} -Properties msDS-AllowedToDelegateTo | Select-Object -ExpandProperty msDS-AllowedToDelegateTo

It will list all services to which the account can present delegated credentials

answered Sep 30 '21 at 08:16

Marcelo Farinelli

11
1

Rod · Answer 3 · 2019-08-21T04:49:07.167

The answer from Neroon did not work for me unfortunately, but I come up with a solution for AD user that works in case anyone else is looking for it:

Get-ADUser -filter { SamAccountName -eq "YouAccountSamName" } -Properties TrustedForDelegation | Select SamAccountName, TrustedForDelegation | FT -A

For multiple users:

$users = @('user1', 'user2')
$users | ForEach {Get-ADUser -filter { SamAccountName -eq $_ } -Properties TrustedForDelegation} | Select SamAccountName, TrustedForDelegation | sort -property SamAccountName | FT -A

Getting authentication delegation settings for an AD account from a non Domain controller with Powershell

3 Answers3