Skip to content

userAccountControl 1049088: User, sensitive, can't be delegated

userAccountControl Decoder: Decode Active Directory userAccountControl values (512, 514, 66048, 532480) into flags, see what each means and how to set it, or build one.

Active Directory keeps an account's switches (disabled, password never expires, trusted for delegation…) as bits added up in its userAccountControl attribute: 66048 is 65536 + 512. Type a value from ADSI Edit, Get-ADUser -Properties userAccountControl or a security report to see which flags it holds, what each means and how to change it, or tick flags below to build one. Flag names and values are from Microsoft's UserAccountControl property flags.

Try: 512, 514, 66048, 532480, 4096, 590336

User, sensitive, can't be delegated

1049088 = 0x100200 = 512 + 1048576

ValueFlagMeaning
512
0x200		 NORMAL_ACCOUNT An ordinary user account.
Every user has it; 512 alone is a plain, enabled user.
1048576
0x100000		 NOT_DELEGATED The account can't be delegated by any service, even one trusted for delegation.
Recommended for administrator accounts.
Active Directory Users and Computers: "Account is sensitive and cannot be delegated"
PowerShell: Set-ADAccountControl -AccountNotDelegated $true

Find accounts like this

Exactly this valueGet-ADObject -LDAPFilter "(userAccountControl=1049088)" -Properties userAccountControl
Users with these flagsGet-ADUser -LDAPFilter "(userAccountControl:1.2.840.113556.1.4.803:=1048576)"
LDAP filter(userAccountControl:1.2.840.113556.1.4.803:=1048576)
1.2.840.113556.1.4.803 is LDAP's bitwise AND rule: it matches accounts that have at least these bits, whatever else is set.

Change it: tick flags to build a new value

IncludeValueFlagMeaning
1 Run the logon script. Kept for old clients; the scriptPath attribute is what matters today.
2 The account is disabled and can't sign in.
8 A home folder is required.
16 The account is locked out.
32 The account may have an empty password, whatever the password policy says.
64 The user can't change their own password.
128 The password is stored with reversible encryption, close to plain text.
256 A local account for a user whose main account is in another domain (pre-Windows 2000 domains).
512 An ordinary user account.
2048 The account a domain uses for a trust with another domain.
4096 A computer account: a workstation or a member server.
8192 A domain controller's computer account.
65536 The password never expires.
131072 A Majority Node Set (cluster) logon account.
262144 Interactive sign-in needs a smart card.
524288 Unconstrained delegation: services on this account can act as any user who signs in to them, anywhere.
1048576 The account can't be delegated by any service, even one trusted for delegation.
2097152 Kerberos may use only DES keys for this account.
4194304 Kerberos pre-authentication isn't required.
8388608 The password has expired.
16777216 Constrained delegation with protocol transition: the account can get tickets as a user to the services it's allowed to, without that user's password.
67108864 A read-only domain controller (RODC) computer account.