dcshadow detection from dc event log — free browser tool | fatcousin

drop dc event log + replication state · detect rogue replication writes

input

drop dc security evtx csv + replication metadata

4929/4930/4934/4935 · repadmin partner export · multiple files merged

Select file

correlates nTDSDSA / DRS SPN registration · unregistered replication partners · sensitive attribute replication

limits

heuristic screener · replication metadata format varies — partner correlation is indicative only · not definitive proof of dcshadow

status

>ready