AD Security 101: Non-Default Security Principals with DCSync Rights

DCSync attackers impersonate a domain controller to pull password hashes from a DC via the DRS protocol—no code runs on it, and audit trails are bypassed. Covers Purple Knight detection and defense.

Releases Invoke-DCSync, a PowerShell wrapper around Mimikatz's DCSync feature that impersonates a domain controller to dump account hashes without touching the DC.

Seven Active Directory misconfigurations to find and fix, starting with non-default principals holding DCSync rights and AdminSDHolder permission tampering; each item includes detection pointers and remediation steps.

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

A domain controller should do one thing: control the domain. Why ADDS belongs on a DC and which roles, tools, and apps to keep off it to shrink the attack surface.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.