What are the prerequisites to perform a DCSync attack?

To perform DCSync, an attacker must have compromised an account that is a member of one of the following groups: Domain Admins, Enterprise Admins, Administrators on the domain controller, or the domain controller's computer account. These privileges allow the use of the IDL_DRSGetNCChanges method to replicate credentials. --- **Related reading:** - [Domain Penetration - DCSync](/news/domain-penetration-dcsync) — original article - [An interesting way of bypassing Windows Attachment Manager](/news/an-interesting-way-of-bypassing-windows-attachment-manager) - [Penetration Techniques - Exploitation of Nine Windows Privileges](/news/penetration-techniques-exploitation-of-nine-windows-privileges) - [Penetration Techniques - Pass the Hash with Remote Desktop (Restricted Admin Mode)](/news/penetration-techniques-pass-the-hash-with-remote-desktop-restricted-admin-mode)