There are a number of configuration options we recommend for securing high privileged accounts. One of them, enabling ‘Account is sensitive and cannot be delegated’, ensures that an account’s credentials cannot be forwarded to other computers or services on the network by a trusted application.
Generally speaking, I'm more of a Cat type of guy, but I have to say I really love BloodHound. And if you do too, you are in for a treat... Last week, the ERNW Insight Active Directory Security Summit took place in Heidelberg. (More