Jul 11, 2026 Active Directory 1 min read DCSync with replication rights Any principal granted DS-Replication-Get-Changes rights can pull every hash in the domain, including krbtgt. credential-access dcsync