DCSync

DCSync abuses Active Directory’s own replication protocol: with the Replicating Directory Changes (and -All) rights, an attacker impersonates a domain controller over DRSUAPI and asks a real DC to hand over any account’s password hash — no code runs on the DC itself, so there’s no agent or exploit to trip. It’s the typical end-state of an Active Directory compromise: the krbtgt hash it yields feeds a Golden Ticket, and any user’s hash feeds straight into pass-the-hash. The replication call rides SMB/RPC on port 445.

How It Works

• Hold the rights. DS-Replication-Get-Changes and -All ACLs are meant for Domain Admins and DCs themselves, but a mis-delegated grant hands the same power to an ordinary account.
• Impersonate a DC. secretsdump.py or mimikatz’s lsadump::dcsync speak the same DRSUAPI protocol a real DC uses to replicate, so the target DC has no reason to refuse.
• Pull krbtgt. Syncing the krbtgt account’s hash is the jackpot — it’s the key to forging tickets for the whole domain.
• Or go targeted. A single high-value account (a Domain Admin, a service account) can be synced alone to stay quiet.
• No DC login required. The attack never touches the DC’s filesystem or runs code on it — it looks like a legitimate replication request from wherever the attacker already has rights.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

How to Detect It

• Alert on Event ID 4662 (object access) for the replication GUIDs, raised by any account that isn’t a domain controller.
• Watch for DRSUAPI DsGetNCChanges calls sourced from an IP that isn’t a DC — the clearest sign of impersonation.
• Periodically audit who holds replication ACLs; a mis-delegated grant is often the whole vulnerability.

How to Defend Against It

• Restrict replication rights to domain controllers and tier-0 admins only — nothing else should ever need them.
• Remove mis-delegated ACLs; a BloodHound sweep will surface accounts that can DCSync but shouldn’t be able to.
• Alert on Event 4662 for the replication GUIDs so any use outside a DC gets caught immediately.
• Rotate krbtgt twice on any suspected compromise — once isn’t enough, since the old value stays valid until the second rotation.

Log every account you can DCSync and the hashes it exposes, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.