Resource-based constrained delegation (RBCD) TL;DR: Write msDS-AllowedToActOnBehalfOfOtherIdentity on a computer → impersonate any user to it. Stub — to be filled in. What it is TODO Preconditions / where it applies TODO Technique TODO Detection and defence TODO References TODO