Domain Administrator Compromise

Use the Active Directory Directory Replication Service Remote Protocol (MS-DRSR/DRSUAPI) to request secret attributes for selected domain accounts from a domain controller, simulating directory replication. Depending on the requested data and effective rights, results can include NT password hashes and other credential material. DCSync retrieves directory data; it does not itself validate a password or grant an administrator session.