Domain Users replication rights

Question

Hi,

We just found out our Domain Users security group has the following rights:

Replicate Directory Changes, Replicate Directory Changes All and Replicate Directory Changes In Filtered Set

I read about DCSync attacks. Is it safe to remove these permissions from Domain Users and other users that have these permissions that are not part of domain admins?

Thanks!

Answer 1

Hello Janus Bariñan,

Given that you discovered that the Domain Users security group was granted Replicate the Directory Changes, Replicate Directory Changes All, and Replicate Directory Changes in Filtered Set permissions, this clearly poses a potential security risk. For non-administrator users and non-essential service accounts, from a security perspective, these permissions should be deleted to reduce the possibility of DCSync attacks.

Best Regards,

Yanhong Liu

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.