{"record":{"id":"8568e57b36c6fed3","repo":"projectdiscovery/nuclei","slug":"ds-bind-w","errorCode":null,"errorMessage":"ds bind: %w","messagePattern":"ds bind: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/secretsdump/secretsdump.go","lineNumber":136,"sourceCode":"\tpipe, err := smb.OpenPipe(\"\\\\PIPE\\\\lsass\")\n\tif err != nil {\n\t\t// Fall back to drsuapi-named pipe; both are accepted by the DC.\n\t\tpipe, err = smb.OpenPipe(\"lsass\")\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"open lsass pipe: %w\", err)\n\t\t}\n\t}\n\trpc := gprpc.NewClient(pipe)\n\tif err := rpc.BindAuth(gpdrs.UUID, gpdrs.MajorVersion, gpdrs.MinorVersion, c.creds); err != nil {\n\t\treturn nil, fmt.Errorf(\"drsuapi bind: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = rpc.Transport.Close()\n\t}()\n\n\tbind, err := gpdrs.DsBind(rpc)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds bind: %w\", err)\n\t}\n\n\tdcInfo, err := gpdrs.DsDomainControllerInfo(rpc, bind.Handle, c.Domain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds dc info: %w\", err)\n\t}\n\n\tdomainDN, err := gpdrs.GetDomainDN(rpc, bind.Handle, c.Domain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"ds domain dn: %w\", err)\n\t}\n\n\t// Resolve target -> DN if it doesn't already look like one.\n\tuserDN := target\n\tif len(target) < 3 || (target[:3] != \"CN=\" && target[:3] != \"cn=\") {\n\t\tcracked, err := gpdrs.DsCrackNames(rpc, bind.Handle, 7 /* DS_NT4_ACCOUNT_NAME */, 1 /* DS_FQDN_1779_NAME */, []string{c.Domain + \"\\\\\" + target})\n\t\tif err != nil || len(cracked) == 0 || cracked[0].Name == \"\" {\n\t\t\tcracked, err = gpdrs.DsCrackNames(rpc, bind.Handle, 11 /* DS_UNIQUE_ID_NAME (SID) */, 1, []string{target})","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/secretsdump/secretsdump.go#L118-L154","documentation":"DsBind is the first real DRSUAPI call: it establishes the replication session context with the DC. Failing here means the bind succeeded at the RPC layer but the DC refused to create a DRS context — typically because the caller lacks directory service access rights or the server is not healthy as a DC.","triggerScenarios":"gpdrs.DsBind(rpc) returns an error when the authenticated principal cannot open a directory replication context (no 'Replicating Directory Changes' rights), or the DRSUAPI endpoint is present but broken.","commonSituations":"Using a standard domain user for DCSync; DC in a degraded state (AD replication paused); target is a read-only DC with restrictions.","solutions":["Use an account with Domain Admin or 'Replicating Directory Changes (All)' on the domain head","Grant the missing ACE explicitly: dsacls 'DC=acme,DC=local' /G acme\\\\user:CA;'Replicating Directory Changes';","Verify DC health: dcdiag on the target","Try another DC in the same domain"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"secret, err := c.DCSync(target)\nif err != nil && strings.Contains(err.Error(), \"ds bind:\") {\n    // DC refused the DRS context: almost always rights, retry with elevated account\n    return err\n}","preventionTips":["Use accounts holding 'Replicating Directory Changes' rights by default for DCSync steps","Check DC health (dcdiag) after repeated DsBind failures","Keep a verified Domain Admin credential path for replication stages of a chain"],"tags":["dcsync","drsuapi","permissions","active-directory"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}