Assume that no administrative tools are installed, and a users rights are limited to running Powershell, and standard user access to Active Directory.

  • Is it possible for a user in this limited situation to verify AD replication? (repadmin is not available)

  • In theory, what would a Powershell script need to inspect AD replication relevant for GPO processing and account replication?

  • standard user access to Active Directory standard users do not have access to replication data. I'm also inclined to think it isn't necessary or useful to restrict this to a standard user to perform this function, or to not use the existing tools. – Greg Askew Feb 26 '19 at 17:41

This is not really possible, depending on what you are trying to achive. A (default) user is missing read access rights to nearly all the important objects and APIs, even when the toolchain was installed.

A user could verify the replication of his own object (change passowrd, verify credentials against DCs), but access to replication protocols, wmi dsquery (which will be missing without RSAT), the complete \root\microsoftdfs namespace and all the necessary rpc endpoints ace ACL'd against such access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.