A county AD review finds DCSync-class replication rights granted to a normal user account that is not a domain controller. What should the tester treat as the core risk?
Select an answer to reveal the explanation.
Short Explanation
Picture giving a random desk clerk the master key to every vault in the courthouse. DCSync-class rights on a normal user mean that account can request directory secrets like a domain controller would. That is not a naming quirk — it is a critical AD privilege problem.
Full Explanation
Replication-related directory permissions (commonly framed as DCSync-class rights) allow a principal to request sensitive directory data as if it were a domain controller. When those rights appear on ordinary users or computers, they represent a high-severity Active Directory misconfiguration. Display names, printer queues, and assumptions that only Domain Admins can hold such rights miss the control question. Assessors should treat unexpected replication rights on non-DC principals as a priority finding and recommend immediate review of who holds them and why.