As part of identifying accounts with "unconstrained Delegation" , it came to our notice that all domain controllers are configured that way.
Can i change "unconstrained delegation" setting on all domain controllers in the org? what would break if i do so?