DCSync Rights Auditor

Paste a DACL export over the domain head (PowerView Get-DomainObjectAcl, DACL Reader findings, or BloodHound edges). The tool correlates the two replication rights per principal — DS-Replication-Get-Changes + Get-Changes-All — and tells you exactly who can DCSync, separating the expected Tier-0 baseline from principals that shouldn't have it. Analyzed locally — nothing leaves your browser.