Skip to content
System hardening
ASD ISMISM-1935

ASD ISM 1935 Prevent unconstrained delegation in domain services

What it says

Computer accounts are not configured for unconstrained delegation.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure computer accounts do not allow unrestricted delegation to protect security.

Unconstrained delegation is a setting that, if misconfigured, can allow attackers to impersonate others in your network. It's crucial to prevent this to avoid sensitive information being exposed or systems being misused by those who shouldn't have access.

Why it matters

Unconstrained delegation could let attackers impersonate privileged users and access domain resources, exposing sensitive data and compromising critical systems.

How to implement

  1. IT team should review the current delegation settings on server accounts to ensure they are not set for unconstrained delegation.

    This involves using administrator tools to check each server's properties and ensure that sensitive configurations are disabled.

  2. System administrators need to document each server's delegation settings.

    They should capture which servers have constrained delegation enabled and keep a record in a secured document.

  3. Managers should verify that all team members responsible for server management understand the risks associated with unconstrained delegation.

    Host a training session to explain these risks and the importance of configuring delegation correctly.

  4. The IT manager should schedule regular audits of the server settings.

    Use a checklist detailing the correct configurations and check each server aligns with these security practices.

  5. System owners should implement a change management process.

    This ensures any changes to delegation settings are documented and approved by a responsible person before being applied, preventing accidental exposures or misconfigurations.

Keep it running

Audit AD computer accounts for "Trust this computer for delegation" and ensure unconstrained delegation is disabled; investigate and remediate any accounts with it enabled.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The server configuration audit logs: Request logs that detail changes to server settings concerning delegation.

    Look at

    The timestamps and the changes made.

    Good evidence

    Shows logs with approved changes and dates indicating regular audits.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Documentation on delegation settings: Obtain the record that lists the delegation settings of each server.

    Look at

    Clear annotations of which servers have unconstrained delegation turned off.

    Good evidence

    Includes a detailed list with each server clearly marked.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Training records: Request evidence of training sessions conducted on the risks of unconstrained delegation.

    Look at

    Participant lists and session content.

    Good evidence

    Contains dates, list of attendees, and topics covered.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Change management records: Request proof of change management processes for delegation settings.

    Look at

    The list of approved changes and the authorisations given.

    Good evidence

    Includes dates, detailed change descriptions, and responsible approvers.

  5. Check 5 of 5What an auditor asks for

    Ask for

    A report on security incidents: Request any incident reports related to delegation settings.

    Look at

    Past incidents where misconfigured settings led to issues.

    Good evidence

    Includes resolved incidents with actions taken to prevent future occurrences.

Mappings

Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.9Configuration management for secure IT systemsPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.