Skip to main content
Applies to BloodHound Enterprise and CE The ability to modify the msDS-AllowedToActOnBehalfOfOtherIdentity property allows an attacker to abuse resource-based constrained delegation to compromise the remote computer system. This property is a binary DACL that controls what security principals can pretend to be any domain user to the particular computer object. This clip demonstrates how to abuse this edge:

​
Abuse Info

See the AllowedToAct edge section for abuse info

​
Opsec Considerations

See the AllowedToAct edge section for opsec considerations

​
Edge Schema

Source: User, Group, Computer
Destination: User, Computer
Traversable: Yes

​
References