DCSync Rights Auditor

Paste a DACL export over the domain head — from Windows (PowerView Get-DomainObjectAcl, DACL Reader findings, BloodHound edges) or Linux-native (NetExec -M daclread, Impacket dacledit.py -action read). The tool correlates the two replication rights per principal — DS-Replication-Get-Changes + Get-Changes-All — and tells you exactly who can DCSync, separating the expected Tier-0 baseline from principals that shouldn't have it. Analyzed locally — nothing leaves your browser.

Grab your data from either stack — both feed the same analysis:

Get-DomainObjectAcl "DC=<dom>,DC=local" -SearchScope Base -ResolveGUIDs
Get-DomainObjectAcl "DC=<dom>,DC=local" -ResolveGUIDs | Export-Csv out.csv -NoTypeInformation
Get-DomainObjectAcl "DC=<dom>,DC=local" -ResolveGUIDs | ConvertTo-Json

nxc ldap <dc-ip> -u <user> -p <pass> -M daclread -o TARGET_DN='DC=<dom>,DC=local' ACTION=read
dacledit.py -action read -principal <user> -target-dn 'DC=<dom>,DC=local' <domain>/<user>:<pass>