Test-ReplicationPermissions previously only scanned Allow ACEs, so an
explicit Deny on the DCSync extended rights (common in hardening
baselines that Deny a broad group and Allow only named service
accounts) was invisible to the pre-flight check: it reported
"verified" while Get-ADReplAccount still failed with "Replication
access was denied". The check now flags exactly which right is
blocked and by which identity's Deny ACE.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
DSInternals 7.0 fetches the AD schema via DRS (GetNCChanges) before
replicating accounts, so the schema NC has its own ACL requirement.
- Test-ReplicationPermissions now validates rights on both the
domain NC and the configuration NC (schema NC inherits from it).
- Updated README with dsacls delegation examples and dual-NC
least-privilege requirements.
- Improved 'Replication access was denied' error message to name
both NCs and explain the DSInternals 7.0 change.
- Diagnostic dump now includes SchemaDN.
All versions bumped to unified v2.4.4.
- Unified project versioning (v2.2.0) across all scripts, settings template,
and documentation. All components now share a single version number.
- Added Test-ReplicationPermissions to Test-WeakADPasswords.ps1 to validate
the three required AD replication extended rights before DCSync, providing
clear fail-fast errors when permissions are missing.
- Updated CHANGELOG.md with unified versioning strategy and release history.
- Updated README.md with versioning section and improved troubleshooting docs.
tomas.kracmar
Tom Frost