Posture check · Delegation and Kerberos
Directory synchronization account can replicate directory secrets (T1003.006)
This account looks like a directory synchronization account, which needs to replicate password hashes. Confirm it is yours. It can read every password in the domain.
Why it matters
Anyone who takes over this account, or the server it runs on, can read every password in the domain.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Active Directory.
It reads:
- The directory attributes
objectSid,userAccountControlandaccountEnabled - Directory permissions (access control entries)
- The privilege tier classification
- The forest each domain belongs to
Tiered Fidelity™ level: Constrained
Every finding from this check carries the Constrained level.
- TheoreticalConfigured in the directory. Nothing else checked.
- ConstrainedThis checkA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
Why there's no automatic fix
Select Fire has no step for this check, so the fix is by hand.
How to fix it
Confirm the account belongs to your synchronization service, and protect it and its server like a domain controller.
By hand: Remove this account's replication rights. If this is your synchronization account, keep its rights and protect its server as Tier 0. If you don't recognize it, remove its replication rights on the domain. Removing them stops password hash synchronization.
If someone uses it
This detection rule raises an alert when the attack this exposure invites shows up in your domain controllers' events.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.