Audit users with risky delegation flags
Documentation: Microsoft Learn
Get-ADUser requests the delegation-related properties explicitly because they are not returned by default.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-ADUser -Filter 'Enabled -eq $true' -Properties TrustedForDelegation,TrustedToAuthForDelegation,AccountNotDelegated |
Where-Object { $_.TrustedForDelegation -or $_.TrustedToAuthForDelegation } |
Select-Object SamAccountName,Enabled,TrustedForDelegation,TrustedToAuthForDelegation,AccountNotDelegated |
Sort-Object SamAccountName- Stage 1Get-ADUser
-Filter -Properties - Stage 2Where-Object
Positional values or no named parameters - Stage 3Select-Object
Positional values or no named parameters - Stage 4Sort-Object
Positional values or no named parameters
How it works
Get-ADUser requests the delegation-related properties explicitly because they are not returned by default. The filter keeps the directory query broad enough to remain readable, then Where-Object keeps only enabled accounts with delegation enabled. The output is a review list; it does not change an account.
Adapting it
Add SearchBase to scope the review to a tier or OU. For service accounts, join the result with SPN data rather than assuming every delegated user is equally exposed.
Primary documentation
Where-Object reference · Select-Object reference · Sort-Object reference
