DS-Replication-Get-Changes-All is an Active Directory extended right that permits a principal to request sensitive replicated directory data, including secret attributes such as password-related material, when combined with the proper replication permissions. It is normally intended for highly trusted directory replication scenarios, not for broad delegation to ordinary users or service accounts.
This right matters because attackers who obtain an account with replication privileges can abuse the same protocol logic that domain controllers use, a technique often associated with DCSync. If granted too broadly, it can enable credential extraction without direct access to a domain controller. Defenders should tightly limit who receives this permission, review delegation paths, and monitor directory replication activity and audit events for unusual access patterns.