thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

DCSync

An attack that impersonates a domain controller to request password hashes from Active Directory via replication.

Definition

Using the Directory Replication Service protocol, an account with replication rights (such as Domain Admins) can request credential data for any user, including KRBTGT, without running code on a DC. Mimikatz and Impacket secretsdump implement it. Detection monitors replication requests from non-DC hosts (Event ID 4662 with replication GUIDs).

Example

mimikatz lsadump::dcsync /user:corp\krbtgt

Exam tip

Replication requests from a workstation IP are a high-fidelity DCSync indicator.

Related terms