Critical severityNIST SP 800-6133 steps · 6 phases

Domain Compromise: DCSync Rights, DA ACE, or GenericAll Chain Response (Critical)

Emergency response steps for a domain-compromise scope when unauthorized replication ACEs are added to the domain object, unauthorized members are added to Domain Admins, or privilege escalation is detected via a GenericAll/WriteDACL chain over DA/Tier-0.

Updated: June 13, 2026

Information note

Informational note: When DCSync rights or a GenericAll ACE is detected, the attacker should be considered to have full control of the domain. Monitor credential extraction operations performed via the MS-DRSR protocol under MITRE T1003.006 in DC audit logs (Event ID 4662 with GUID filters). During response, first disable the affected account, then perform a double reset of the krbtgt password, and enforce forced ticket renewal for all privileged accounts.

Prepare

5 steps

Audit policy
`Audit Directory Service Changes` and `Audit Directory Service Access` (Success + Failure) are enabled on DCs; Advanced Audit Policy must be fully configured.
Tier-0 inventory
The list of Domain Admins, Enterprise Admins, Schema Admins, KRBTGT, DC machine accounts, and Tier-0 service accounts must be current and signed.
Kerberos playbook ready
The KRBTGT double-rotation procedure (≥10-hour wait, auth error KPI monitoring) must be documented and tested.
DSRM password vault
The DSRM password for every DC must be current; access must be stored in a closed vault accessible only to the authorized IR team.
Escalation
AD owner + CISO + change board; domain-compromise decisions require a signed change ticket at every step.

Detect & Analyze

5 steps

Domain Compromise: DCSync Rights, DA ACE, or GenericAll Chain Response (Critical)

Prepare

Detect & Analyze

Contain

Eradicate

Recover

Post-Incident