How can an attacker maintain persistence using DCSync without being a Domain Admin?

An attacker can grant DCSync rights to a regular domain user by adding specific Access Control Entries (ACEs) to the domain object using tools like PowerView. The required ACEs are DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes (with a specific GUID). This 'Shadow Admin' can then export all domain hashes without being a member of high-privilege groups. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [An interesting way of bypassing Windows Attachment Manager](/news/an-interesting-way-of-bypassing-windows-attachment-manager) - [Penetration Techniques - Exploitation of Nine Windows Privileges](/news/penetration-techniques-exploitation-of-nine-windows-privileges) - [Penetration Techniques - Pass the Hash with Remote Desktop (Restricted Admin Mode)](/news/penetration-techniques-pass-the-hash-with-remote-desktop-restricted-admin-mode)