4662 Security log · DS Access high severity high volume

Windows Event ID 4662 — An operation was performed on an object

Operation on an Active Directory object. AccessMask and ObjectType are key. Requires SACL on AD objects.

Why event 4662 matters

DCSync uses replication rights GUIDs in AccessMask: {1131f70a-e0f9-4f2b-bc37-4d3b2b12e2f7} (DS-Replication-Get-Changes-All) and {19195a5b-6da0-11d0-afd3-00c04fd930c9}. When a non-DC account accesses these rights, it indicates DCSync via Mimikatz or Impacket secretsdump.

How to detect it

Alert: AccessMask contains replication GUIDs from non-DC accounts. This is the primary DCSync indicator on the DC. Requires SACL on domain NC head.

Log source
Security
Advanced Audit Policy — enable the 'DS Access' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameObjectNameObjectTypePropertiesAccessMask

MITRE ATT&CK mapping

Tactic Technique
Credential Access DCSync (T1003.006)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: DCSync — Replication Rights Access
status: stable
description: Non-DC account using replication rights — DCSync attack
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4662
        AccessMask|contains:
            - '1131f70a-e0f9-4f2b-bc37-4d3b2b12e2f7'
            - '19195a5b-6da0-11d0-afd3-00c04fd930c9'
    filter_dc:
        SubjectUserName|endswith: '$'
    condition: selection and not filter_dc
falsepositives:
    - Azure AD Connect directory sync
    - Legitimate DC replication
level: critical
tags:
    - attack.credential_access
    - attack.t1003.006
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4662   // An operation was performed on an object
| project TimeGenerated, Computer, SubjectUserName, ObjectName, ObjectType, Properties, AccessMask
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4662
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# An operation was performed on an object — add EventData fields: SubjectUserName, ObjectName, ObjectType, Properties`
Hunt event 4662 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related DS Access events

4928 An Active Directory replica source naming context was established 4929 An Active Directory replica source naming context was removed 4930 An Active Directory replica source naming context was modified 4932 Synchronization of a replica of an Active Directory naming context has begun 4933 Synchronization of a replica of an Active Directory naming context has ended 4934 Attributes of an Active Directory object were replicated 4935 Replication failure begins 4936 Replication failure ends 4937 A lingering object was removed from the replica 5136 A directory service object was modified 5137 A directory service object was created 5138 A directory service object was undeleted

Frequently asked questions

What is Windows Event ID 4662?

An operation was performed on an object. Operation on an Active Directory object. AccessMask and ObjectType are key. Requires SACL on AD objects.

Which log records event 4662?

Event 4662 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'DS Access' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4662?

Event 4662 is associated with: DCSync (T1003.006).

How do you detect activity around event 4662?

Alert: AccessMask contains replication GUIDs from non-DC accounts. This is the primary DCSync indicator on the DC. Requires SACL on domain NC head.