6.3.9 Validate domain replication rights
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A domain identity with suspected effective replication rights at the domain root. Member-server administrator access is not sufficient.
Where to look: Validate the domain naming-context security descriptor and controlled trustee membership. Resolve replication extended rights and necessary access conditions, then select a bounded account-specific replication proof during practice.
Expected behavior / secure boundary: DC replication and narrowly delegated replication services are legitimate. Unintended secret-replication rights on a controlled principal are highly consequential. Successful LDAP/SMB authentication does not establish DRS authorization.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.3.9.1 Baseline — Windows PowerShell
Run: Windows PowerShell with reviewed PowerView. Requires: Read access to the real domain naming-context security descriptor. Effect: Reads replication-right candidates; this command does not perform DCSync.
Get-DomainObjectAcl -Identity 'DC=DOMAIN,DC=TLD' -ResolveGUIDs |
Where-Object { $_.ObjectAceType -match 'Replication-Get-Changes' }
What this checks: The displayed ACL query selects replication-right candidates at the domain naming context; replace the entire naming-context DN with the actual domain DN. It is not a complete effective-access calculation. After validation, the linked procedure uses an account-specific replication proof rather than full-domain collection by default.
6.3.9.2 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Principal: EXAMPLE\sync_reader
Domain-root rights: Get-Changes + Get-Changes-All
Account-specific DRS request: access denied
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| Rights listed | A replication candidate, not the final effective-access result. | Resolve scope, trustee, GUIDs and applicable rules. | §6.2.5.1 — Enumerate and validate effective object permissions |
| DRS access denied | The selected operation failed authorization or a related condition. | Recheck effective rights and identity; retain previously proven authentication. | §6.2.5.1 — Enumerate and validate effective object permissions |
| One account secret returned | Selected domain material was obtained in that context. | Classify it and preserve bounded evidence; do not infer every other objective is complete. | §6.3.2.1 — Classify recovered credentials and their scope |
Stop when: Domain-root effective-right candidates and the bounded next validation are recorded.
Revisit only when: The controlled trustee, domain-root rights or DRS route changes.
6.3.9.3 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | Effective rights and protocol prerequisites are verified: select the bounded canonical procedure. | §6.3.9.4 — Validate domain replication rights |
| Ruled out in this context | Only local administrative rights are present: reject DCSync as an automatic consequence. | §6.2.6.1 — Validate host-specific access rights |
| Inconclusive / failed check | Timeout or denied operation: distinguish routing/RPC from rights and credential problems. | §6.5.1.1 — Diagnose the failed boundary |
6.3.9.4 Tooling and complete procedure
Impacket secretsdump can perform the selected DRS operation; Mimikatz is a distinct client alternative. Both require effective domain replication rights and protocol connectivity. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.