ADPRIV-028: Users with DCSync Rights
- Platform
- Active Directory
- Category
- AD Privileged Account Security
- Severity
- Critical
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check reads nTSecurityDescriptor on the domain root (DC=domain,DC=tld) via LDAP and walks every ACE in the DACL. It flags ACEs where AccessControlType is Allow, ActiveDirectoryRights includes ExtendedRight, and ObjectType matches one of the replication GUIDs: - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes) - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes-All) - 89e95b76-444d-4c62-991a-0facbeda640c (DS-Replication-Get-Changes-In-Filtered-Set, used by RODC replication and abused by DCSync variants) For each matching ACE the trustee SID is resolved and compared against the baseline expected set: Enterprise Domain Controllers (S-1-5-9), the domain controllers group, BUILTIN\Administrators, Domain Admins, Enterprise Admins, SYSTEM, and the default Administrator account. Any other trustee, including service accounts, application identities, Exchange groups, Azure AD Connect sync accounts placed there manually, or nested groups whose membership leaks DCSync to a wider population, is reported as a finding. The check also resolves group membership transitively so that a non-privileged user nested into a group that holds DCSync rights surfaces by their own DN rather than only the group DN.
Why it matters
DCSync is the canonical credential-extraction primitive in Active Directory. A principal with DS-Replication-Get-Changes plus DS-Replication-Get-Changes-All can call DRSGetNCChanges against any writable domain controller and receive the full secret attributes (unicodePwd, ntPwdHistory, supplementalCredentials, lmPwdHistory) for every account in the domain. This includes the krbtgt account, which is the seed for Golden Tickets. Once the krbtgt hash is exfiltrated the attacker can forge TGTs for any user, including non-existent SIDs, and that capability persists until krbtgt is rotated twice with a wait period in between. Because DCSync uses the standard replication RPC, it does not generate logon events on the DC, does not require code execution on the DC, and can be performed from any host that can reach TCP 135 / dynamic RPC on a DC. The blast radius of a single unauthorized DCSync grant is therefore equivalent to full domain compromise, with persistence that survives password resets of every account except krbtgt itself.
Attack path
1. Reconnaissance: the attacker enumerates the domain head ACL with BloodHound (SharpHound -CollectionMethod ACL,DCOnly) or PowerView (Get-DomainObjectAcl -SearchBase (Get-ADDomain).DistinguishedName -ResolveGUIDs | Where-Object { $_.ObjectAceType -match "Replication-Get-Changes" }). BloodHound renders the result as GetChanges and GetChangesAll edges. 2. Edge identification: BloodHound highlights a path from a compromised principal (a service account, a help-desk group, or a misconfigured application identity) to the domain object via the two replication edges. 3. Capability acquisition: if the attacker controls a principal that already holds both rights, no further work is needed. If they hold WriteDacl on the domain object (see ADACL-001) they add the two ACEs to a controlled account, typically with the extended-right GUIDs and an Allow Allow pair. 4. Exploitation: the attacker runs DCSync. Common tooling includes mimikatz (lsadump::dcsync /domain:corp.contoso.com /user:krbtgt), impacket-secretsdump (secretsdump.py -just-dc CORP/user@dc01), SharpKatz, or DSInternals (Get-ADReplAccount). The DC responds with the requested secrets over the standard replication RPC. 5. Forgery: with the krbtgt NT hash the attacker forges a Golden Ticket (mimikatz kerberos::golden, Rubeus golden) granting arbitrary group membership including Enterprise Admins, and presents it for service tickets to any resource in the forest. 6. Persistence: the attacker may also dump every user hash for offline cracking, every machine account hash to enable Silver Tickets, and every gMSA blob (msDS-ManagedPassword) to compromise managed service identities. The replication ACE itself is rarely removed by the attacker because the operation is logged as legitimate replication.
How Guerrilla assesses it
Guerrilla binds to a writable DC, retrieves the domain object with Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties nTSecurityDescriptor, and iterates the DACL. Each ACE is filtered to AccessControlType = Allow, ActiveDirectoryRights includes ExtendedRight, and ObjectType matches one of the three replication GUIDs. Trustees are translated from SID via System.Security.Principal.SecurityIdentifier.Translate so that orphaned SIDs and cross-domain principals are reported as raw SIDs rather than silently dropped. For each non-baseline trustee that is a group, the check expands membership recursively with Get-ADGroupMember -Recursive so the effective DCSync population is visible. Inherited ACEs are reported separately from explicit ACEs because inherited ACEs usually indicate a problem higher in the tree that needs to be fixed at its source. The LDAP query path avoids dependency on the AD: PSDrive so the check works against any reachable DC even when RSAT is not loaded locally.
Recommended value
Only domain controller computer accounts and default administrator account have replication rights. No additional users or groups granted DCSync permissions
Remediation
Audit the domain root ACL for 'Replicating Directory Changes' and 'Replicating Directory Changes All' using (Get-ACL 'AD:\DC=domain,DC=com').Access | Where-Object {$_.ObjectType -match '1131f6a[a-d]'}. Remove any unauthorized entries immediately. Investigate whether unauthorized accounts have already performed DCSync
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6(1), AC-3
- CIS Benchmark
- 18.3.1
- ANSSI
- R41
- CIS AD Benchmark
- 4.11.1
- MITRE ATT&CK
- T1003.006