ASD ISM 1935Prevent Unconstrained Delegation in Domain Services
Official control statement
Computer accounts are not configured for unconstrained delegation.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure computer accounts do not allow unrestricted delegation to protect security.
What this means in practice
Unconstrained delegation is a setting that, if misconfigured, can allow attackers to impersonate others in your network. It's crucial to prevent this to avoid sensitive information being exposed or systems being misused by those who shouldn't have access.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2024
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for system hardeningSection
Server application hardeningTopic
Microsoft Active Directory Domain Services account hardening
Why it matters
Unconstrained delegation could let attackers impersonate privileged users and access domain resources, exposing sensitive data and compromising critical systems.
Operational notes
Audit AD computer accounts for "Trust this computer for delegation" and ensure unconstrained delegation is disabled; investigate and remediate any accounts with it enabled.
Implementation tips
- IT team should review the current delegation settings on server accounts to ensure they are not set for unconstrained delegation. This involves using administrator tools to check each server's properties and ensure that sensitive configurations are disabled.
- System administrators need to document each server's delegation settings. They should capture which servers have constrained delegation enabled and keep a record in a secured document.
- Managers should verify that all team members responsible for server management understand the risks associated with unconstrained delegation. Host a training session to explain these risks and the importance of configuring delegation correctly.
- The IT manager should schedule regular audits of the server settings. Use a checklist detailing the correct configurations and check each server aligns with these security practices.
- System owners should implement a change management process. This ensures any changes to delegation settings are documented and approved by a responsible person before being applied, preventing accidental exposures or misconfigurations.
Audit / evidence tips
- AskThe server configuration audit logs: Request logs that detail changes to server settings concerning delegationLook atThe timestamps and the changes madeGoodShows logs with approved changes and dates indicating regular audits
- AskDocumentation on delegation settings: Obtain the record that lists the delegation settings of each serverLook atClear annotations of which servers have unconstrained delegation turned offGoodIncludes a detailed list with each server clearly marked
- AskTraining records: Request evidence of training sessions conducted on the risks of unconstrained delegationLook atParticipant lists and session contentGoodContains dates, list of attendees, and topics covered
- AskChange management records: Request proof of change management processes for delegation settingsLook atThe list of approved changes and the authorisations givenGoodIncludes dates, detailed change descriptions, and responsible approvers
- AskA report on security incidents: Request any incident reports related to delegation settingsLook atPast incidents where misconfigured settings led to issuesGoodIncludes resolved incidents with actions taken to prevent future occurrences
Cross-framework mappings
How ISM-1935 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.9 | ISM-1935 mandates that Active Directory computer accounts are not configured for unconstrained delegation, a specific security measure to... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System hardening
See all Guidelines for system hardening controls, or browse the full ASD ISM library.