A county AD review finds DCSync-class replication rights granted to a normal user account that is not a domain controller. What should the tester treat as the core risk?
Select an answer to reveal the explanation.
Short Explanation
Picture giving a random desk clerk the master key to every vault in the courthouse. DCSync-class rights on a normal user mean that account can request directory secrets like a domain controller would. That is not a naming quirk — it is a critical AD privilege problem.
Full Explanation
Directory replication permissions such as DCSync-class rights on a principal that is not a domain controller are a severe privilege misconfiguration. For a county Active Directory estate, a normal user (or similarly non-DC account) that can replicate directory secrets can obtain credential material at domain scale—turning a seemingly ordinary identity into a path toward broad compromise of systems that authenticate municipal staff and applications.
Missing a descriptive display name is cosmetic and unrelated to replication rights. It is false that only Domain Admins can ever receive such rights; mis-delegation is exactly why the finding appears. Replication rights are not about printer queues and must not be ignored in AD assessments.
Exam caveat: treat non-DC replication rights as near-Tier-0 equivalent risk in path language, while still distinguishing permission presence from completed secret extraction under RoE. CPTS AD judgment emphasizes recognizing dangerous directory permissions by class.
Operational check: enumerate who holds DS-Replication related rights, remove them from non-DC civic accounts, monitor for replication-like requests, and re-validate that only legitimate DCs retain those privileges after change control.