Unconstrained delegation: TGTs handed over

Kerberos delegation lets a service act on behalf of a user. In the unconstrained variant, the user sends their own TGT to the service, which can use it toward any resource.

The attack

If you compromise a host with unconstrained delegation, you harvest the TGT of every user who authenticates there, stored in LSASS. By coercing a DC to authenticate to it (PrinterBug/coercion), you capture the DC's own TGT — and from there DCSync, golden ticket, the domain.

Rubeus monitor /interval:5   # capture incoming TGTs
# + SpoolSample to force the DC to auth

Defence

Eliminate unconstrained delegation (use constrained or resource-based with constraints). Mark sensitive accounts as Account is sensitive and cannot be delegated or in the Protected Users group. Keep DCs out of coercion's reach.