Accounts trusted for unconstrained Kerberos delegation

#Requires -Modules ActiveDirectory
# Non-DC accounts with TRUSTED_FOR_DELEGATION (0x80000) set. Read-only.

$filter = '(&(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))'

$computers = Get-ADComputer -LDAPFilter $filter -Properties TrustedForDelegation, LastLogonDate, OperatingSystem |
    ForEach-Object { [pscustomobject]@{ Type = 'Computer'; Name = $_.Name; Enabled = $_.Enabled; OperatingSystem = $_.OperatingSystem; LastLogonDate = $_.LastLogonDate; DistinguishedName = $_.DistinguishedName } }
$users = Get-ADUser -LDAPFilter $filter -Properties TrustedForDelegation, LastLogonDate |
    ForEach-Object { [pscustomobject]@{ Type = 'User'; Name = $_.SamAccountName; Enabled = $_.Enabled; OperatingSystem = $null; LastLogonDate = $_.LastLogonDate; DistinguishedName = $_.DistinguishedName } }

@($computers) + @($users) | Sort-Object Type, Name

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

A domain-joined machine with the Active Directory module (RSAT) installed.

Reading the output

• Finds objects with TRUSTED_FOR_DELEGATION (0x80000) in userAccountControl and leaves out those with SERVER_TRUST_ACCOUNT (0x2000), because domain controllers carry both by design (Microsoft lists 0x82000 as a domain controller's typical value).
• Per Microsoft, any service running under such an account can impersonate a client requesting the service. Constrained or resource-based constrained delegation limits that to named services.
• Disabled accounts are included and marked Enabled = False.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.