I've been spending hours upon hours trying to learn and understand Windows Authentication, Kerberos, SPNs, and Constrained Delegation in IIS 7.5. One thing I just don't get is why it is "risky" to leave delegation enabled (i.e. not disable delegation for sensitive accounts) for Admins, CEOs, etc. Can someone please explain this to me in simple terms? Please frame your answer with respect to an intranet environment.
My reasoning is that it shouldn't be a concern, because delegation simply allows a front-end web server, for example, to act on the Windows Authenticated person's behalf when communicating to other servers. If the person has access, they have access, I don't understand why this should be a concern.
Please forgive my ignorance. I'm primarily a developer, but my company is running very lean these days and I'm forced to wear the server admin hat too... unfortunately, it still doesn't fit very well, lol.