Get-WinEvent 4662 DCSync

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4662} | Where {$_.Message -like '*1131f6aa*'}

Detect DCSync by searching Event 4662 for directory object accesses with the password replication GUID.

Run it on the DC when you suspect hash theft via DCSync: the attacker with replication permissions (Replicating Directory Changes All) impersonates a DC and requests the hash of any account. Access to the domain object with GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes-All) is the signature. Event 4662 requires directory service object access auditing to be enabled — if it's not, you'll see nothing. It's one of the most reliable detections against DCSync when auditing is properly configured, because nothing legitimate uses that replication GUID except DCs.

Don't use it if directory service object access auditing isn't enabled: Event 4662 won't be generated and the query always returns empty — first verify the policy (Audit Directory Service Access). In domains with many DCs or with backup tools that legitimately use replication (some VSS-based backup solutions don't, but those that replicate NTDS do), you need an allowlist of accounts. And watch out for the format: the GUID appears in the Properties field of the event, so filtering by Message is fragile depending on the system language — if the DC is in English, the message text changes; better to filter by the Properties array in the full query.