So there was this blog post that talking about a number of ways to dump windows credentials by @lanjelot [definitly someone to follow] - here: https://www.securusglobal.com/community/2013/12/20/dumping-windows-credentials/ and at the very bottom of this post it says "AD Replication (EXPERIMENTAL)" What it boils down to is if you can position a system that can do DNS resolution to the target domai…