A transit engineer finds unconstrained delegation configured on a server account. How should this be treated in the assessment narrative?

When a transit engineer finds unconstrained delegation on a server account, treat it in the narrative as a high-value dangerous-delegation misconfiguration class that elevates identity risk and should be reported conceptually. It is not a cosmetic Active Directory attribute with no security implications. It is not proof that Kerberos has been retired. It is also not silent authorization to immediately dump every domain controller without documenting the finding class. Exam caveat: discuss delegation risk themes without turning the answer key into an exploit runbook. Operational check: identify the principal and delegation flags with authorized directory reads, explain potential identity impact in municipal terms, recommend constrained or eliminated delegation with an owner, and avoid unapproved DC attacks justified only by the misconfiguration’s existence. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.