Non-administrative accounts do not have DC-Sync (Directory Replication) permissions

Overview

Directory replication permissions on the domain naming context — Replicating Directory Changes, Replicating Directory Changes All, and Replicating Directory Changes In Filtered Set — allow a principal to invoke the directory-replication protocol (DRSUAPI/IDL_DRSGetNCChanges) and pull every credential hash and Kerberos key in the domain. By design these permissions are granted to Domain Controllers, Enterprise Domain Controllers, the Microsoft Entra Connect MSOL_ account, and a small number of Microsoft service principals. When a non-administrative user, group, or service account holds these permissions — typically because of legacy delegation, an over-permissive ACL on the domain root, or an old administrative install — a threat actor who compromises that account can pull the full credential corpus from any machine in the domain, without ever logging on to a domain controller, without writing files, and without producing a Windows Security event by default. Extracted credentials enable credential replay and lateral movement at will, and the krbtgt key enables long-lived authentication forgery and forest-wide compromise. Microsoft Defender for Identity’s “Remove non-admin accounts with DC-Sync permissions” posture assessment lists every non-admin principal that holds these rights so they can be removed.

Remediation

• Remove non-admin accounts with DC-Sync permissions
• DCSync attack (replication of directory services)

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Identity threat protection
Product	Active Directory
Feature	Permissions and delegation
Area	Privileged access
ATT&CK	T1003.006 DCSync
Licence	ATA
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.