Labs / Active Directory, defender view
An old print server trusted for delegation
Decode userAccountControl values in a computer export and find the non-DC server with unconstrained delegation, which caches the Kerberos tickets of everyone who connects to it.
Briefing
A computer trusted for unconstrained delegation receives a copy of each connecting user’s TGT so it can act on their behalf anywhere. Domain controllers have it by design. On any other server, compromising that one machine yields tickets for every admin who touches it.
computers.ldf is an export of computer objects. uac-flags.txt lists the bits you need.
admin-ws · Active Directory, defender view
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.