Event ID 4662Audit SuccessSecurityT1003.006

Windows Event ID 4662 — Operation Performed on Active Directory Object

Logged when an operation is performed on an Active Directory object — such as a user, computer, or the domain partition itself. The critical event for detecting DCSync attacks and unauthorized AD replication.

MITRE ATT&CK

Technique

T1003.006 · DCSync

Tactic

Credential Access

View on attack.mitre.org →

Why It Matters

Attackers with sufficient privileges use DCSync (via Mimikatz or Impacket's secretsdump) to impersonate a domain controller and request password hashes for any account — including krbtgt and domain admins — without ever touching the DC filesystem. Event ID 4662 with replication-related access rights is the primary detection signal. A non-DC account requesting DS-Replication-Get-Changes-All is almost never legitimate.

Key Fields

Object DNThe distinguished name of the AD object accessed — the domain partition (DC=...) indicates domain-level replication
Access Mask / PropertiesLook for DS-Replication-Get-Changes (1131f6aa...) and DS-Replication-Get-Changes-All (1131f6ad...) — together they allow full password hash extraction
Subject Account NameThe account performing the operation — should only ever be machine accounts ending in $ (actual DCs). Any user account is suspicious.
Object TypedomainDNS indicates domain partition access — the target of a DCSync attack

Investigation Tips

  1. 1.Filter for Subject Account Name that does NOT end in $ — legitimate replication is always performed by computer accounts (DCs), not user accounts.
  2. 2.Look for GUID 1131f6ad (DS-Replication-Get-Changes-All) — this right is required to dump password hashes and is rarely granted to non-DCs.
  3. 3.Correlate with 4624 logon events for the same account immediately before — Impacket secretsdump authenticates then immediately replicates.
  4. 4.Check if the source machine is a known DC using your CMDB or the computer account list in AD. An unknown host requesting replication rights is a confirmed DCSync.
  5. 5.Is this always malicious? No — legitimate backup tools (Veeam, Azure AD Connect) also trigger 4662 with replication rights. Verify the account and source host before escalating.
  6. 6.Enable 'Audit Directory Service Access' under Advanced Audit Policy to generate 4662 — it is off by default on many DCs.

Go deeper: the full DCSync Attack Detection — Mimikatz Replication & AD Credential Dumping guide

Explore the related technique, investigation steps, and evidence to consider alongside this event.

Read the DCSync Attack Detection — Mimikatz Replication & AD Credential Dumping guide →

See Event ID 4662 in your logs

Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.

Decode an event →
← All detection guides·Decode an event →