Skip to main content
AD Academy
Back to all events
4662Security (DC)Security & attacksCRITLast updated:

Operation on an AD object — the DCSync detection point

What it means

A detail-rich event. If Properties include the DS-Replication-Get-Changes-All GUID and the account is not a DC, that is DCSync.

First steps

  1. 1Alert on GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 from a non-DC account.
  2. 2Review who holds replication rights — that is how all hashes get stolen.
  3. 3If confirmed, treat the domain as fully compromised (reset krbtgt twice).

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.