DRSUAPI (MS-DRSR)
DRSUAPI is the RPC interface behind the Directory Replication Service
Remote Protocol ([MS-DRSR]) — the protocol domain controllers use to pull
replication changes from each other and keep their copies of
NTDS.dit in sync. DRSR actually defines two RPC interfaces:
drsuapi (replication — the interesting one) and dsaop (name preparation).
The marquee method is IDL_DRSGetNCChanges (opnum 3): a client DC binds to
the drsuapi interface (IDL_DRSBind, opnum 0), then requests changes for a
naming context (NC). The server checks that the caller holds the Replicating
Directory Changes rights on the NC — in practice the
DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended
rights — and, if granted, streams back the requested objects including secret
attributes (password hashes, Kerberos keys).
DCSync
That access check is the whole ballgame. Members of Domain Admins, Enterprise Admins, and the DCs themselves hold replication rights by default — so a compromised DA (or any account explicitly delegated those extended rights, a classic weak-permissions misconfiguration) can impersonate a DC and request password data for any account, over the network, without ever touching the DC’s disk:
# Mimikatz — pull krbtgt's keys straight from the DC
Invoke-Mimikatz -Command '"lsadump::dcsync /user:DOMAIN\krbtgt"'
# Impacket — dump everything
secretsdump.py DOMAIN/user:pass@dc01.corp.localMimikatz’s lsadump::dcsync and Impacket’s secretsdump.py are both just
MS-DRSR clients speaking IDL_DRSGetNCChanges. MITRE tracks this as
T1003.006 — OS Credential Dumping: DCSync.
DCSync’ing krbtgt yields golden-ticket
material; DCSync’ing a trust account’s keys feeds
trust pivoting.
Detection
- Event 4662 (directory service access) on the DC: an access to the domain
object by an account exercising
DS-Replication-Get-Changes*from a host that is not a DC is the canonical indicator — legitimate replication only ever originates from DCs. - Network baselines: drsuapi RPC traffic between non-DC endpoints is anomalous by definition.
Related
- ntds-dit — the database this protocol replicates; DCSync is its no-touch extraction path
- dcerpc — the transport DRSUAPI rides on
- golden-and-silver-ticket-attacks, active-directory-trust-pivoting — what the stolen keys buy