dsacls

Windows command-line tool (dsacls.exe) for displaying and changing access control entries on Active Directory Domain Services objects. The reviewed write example grants the Replicating Directory Changes and Replicating Directory Changes All extended rights on a domain naming-context root; assigning these rights to an unexpected principal can enable DCSync and create persistent privileged access. This is a high-impact DACL change, not a stealth operation.