{"record":{"id":"ccd91317f390745b","repo":"projectdiscovery/nuclei","slug":"dsgetncchanges-returned-no-objects","errorCode":null,"errorMessage":"DsGetNCChanges returned no objects","messagePattern":"DsGetNCChanges returned no objects","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/secretsdump/secretsdump.go","lineNumber":167,"sourceCode":"\t// Resolve target -> DN if it doesn't already look like one.\n\tuserDN := target\n\tif len(target) < 3 || (target[:3] != \"CN=\" && target[:3] != \"cn=\") {\n\t\tcracked, err := gpdrs.DsCrackNames(rpc, bind.Handle, 7 /* DS_NT4_ACCOUNT_NAME */, 1 /* DS_FQDN_1779_NAME */, []string{c.Domain + \"\\\\\" + target})\n\t\tif err != nil || len(cracked) == 0 || cracked[0].Name == \"\" {\n\t\t\tcracked, err = gpdrs.DsCrackNames(rpc, bind.Handle, 11 /* DS_UNIQUE_ID_NAME (SID) */, 1, []string{target})\n\t\t\tif err != nil || len(cracked) == 0 || cracked[0].Name == \"\" {\n\t\t\t\treturn nil, fmt.Errorf(\"could not resolve %q to a DN\", target)\n\t\t\t}\n\t\t}\n\t\tuserDN = cracked[0].Name\n\t}\n\n\tres, err := gpdrs.DsGetNCChanges(rpc, bind.Handle, domainDN, userDN, dcInfo.NtdsDsaObjectGuid, rpc.GetSessionKey())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"DsGetNCChanges: %w\", err)\n\t}\n\tif len(res.Objects) == 0 {\n\t\treturn nil, fmt.Errorf(\"DsGetNCChanges returned no objects\")\n\t}\n\to := res.Objects[0]\n\tout := &Secret{\n\t\tSAMAccountName:     o.SAMAccountName,\n\t\tDistinguishedName:  o.DN,\n\t\tRID:                o.RID,\n\t\tNTHash:             hex.EncodeToString(o.NTHash),\n\t\tLMHash:             hex.EncodeToString(o.LMHash),\n\t\tUserAccountControl: o.UserAccountControl,\n\t\tPwdLastSet:         o.PwdLastSet,\n\t}\n\tfor _, h := range o.NTHashHistory {\n\t\tout.NTHashHistory = append(out.NTHashHistory, hex.EncodeToString(h))\n\t}\n\tfor _, h := range o.LMHashHistory {\n\t\tout.LMHashHistory = append(out.LMHashHistory, hex.EncodeToString(h))\n\t}\n\treturn out, nil","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/secretsdump/secretsdump.go#L149-L185","documentation":"The replication RPC completed without a transport-level fault but the response contained zero objects, so there is no secret to return. This happens when the resolved DN points at an object that carries no replicated secret (a container or organizational unit), or the DC silently filtered the object out.","triggerScenarios":"Target DN resolved to OU=... or CN=LostAndFound instead of a user/computer object; account exists but its secret attributes are excluded (e.g. RODC filtered attribute set); race where the object was deleted between crack-names and replication.","commonSituations":"Passing a raw DN that looks right but is an OU; syncing machine accounts on DCs with filtered attribute sets; chasing accounts found in stale enumeration data.","solutions":["Target a concrete security principal (user or computer sAMAccountName)","Let the library resolve the target from sAMAccountName or SID instead of hand-writing the DN","Re-verify the object still exists via LDAP immediately before the sync"],"exampleFix":"// before\nconst s = c.DCSync('OU=Employees,DC=acme,DC=local'); // OU carries no secrets\n\n// after\nconst s = c.DCSync('jdoe');","handlingStrategy":"validation","validationCode":"// Only sync objects that are security principals\nif strings.HasPrefix(dn, \"OU=\") || !isPrincipal(dn) {\n    return fmt.Errorf(\"refusing to sync non-principal DN %q\", dn)\n}","typeGuard":"func looksLikePrincipalDN(dn string) bool {\n    return strings.HasPrefix(dn, \"CN=\") && !strings.HasPrefix(dn, \"OU=\")\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"returned no objects\") {\n    // DN resolved but no secret replicated: re-resolve target via sAMAccountName and retry once\n}","preventionTips":["Prefer sAMAccountName/SID targets over hand-written DNs","Skip container-class DNs (OU=, CN=LostAndFound) at the call site","Re-check object existence via LDAP immediately before replication"],"tags":["dcsync","active-directory","data"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}