DCSync is an Active Directory replication technique that asks a domain controller to return directory data as if the caller were another replication peer. In normal operation, domain controllers exchange account and policy data to stay synchronized. When an attacker has the right permissions, that same mechanism can be abused to pull sensitive secrets, including password-derived material and KRBTGT-related data.
This matters because DCSync can turn one foothold into domain-wide compromise without dumping credentials from a single host. Attackers often reach it after gaining high privileges, abusing a trusted machine identity, or exploiting an identity or certificate trust failure. Defenders should treat replication rights as Tier-0 access, tightly control who can replicate directory changes, and monitor for unusual directory replication requests. In practice, DCSync is a common bridge from initial access to durable control of an Active Directory domain.