projectdiscovery/nuclei · error

ds bind: %w

Error message

ds bind: %w

What it means

DsBind is the first real DRSUAPI call: it establishes the replication session context with the DC. Failing here means the bind succeeded at the RPC layer but the DC refused to create a DRS context — typically because the caller lacks directory service access rights or the server is not healthy as a DC.

Source

Thrown at pkg/js/libs/secretsdump/secretsdump.go:136

	pipe, err := smb.OpenPipe("\\PIPE\\lsass")
	if err != nil {
		// Fall back to drsuapi-named pipe; both are accepted by the DC.
		pipe, err = smb.OpenPipe("lsass")
		if err != nil {
			return nil, fmt.Errorf("open lsass pipe: %w", err)
		}
	}
	rpc := gprpc.NewClient(pipe)
	if err := rpc.BindAuth(gpdrs.UUID, gpdrs.MajorVersion, gpdrs.MinorVersion, c.creds); err != nil {
		return nil, fmt.Errorf("drsuapi bind: %w", err)
	}
	defer func() {
		_ = rpc.Transport.Close()
	}()

	bind, err := gpdrs.DsBind(rpc)
	if err != nil {
		return nil, fmt.Errorf("ds bind: %w", err)
	}

	dcInfo, err := gpdrs.DsDomainControllerInfo(rpc, bind.Handle, c.Domain)
	if err != nil {
		return nil, fmt.Errorf("ds dc info: %w", err)
	}

	domainDN, err := gpdrs.GetDomainDN(rpc, bind.Handle, c.Domain)
	if err != nil {
		return nil, fmt.Errorf("ds domain dn: %w", err)
	}

	// Resolve target -> DN if it doesn't already look like one.
	userDN := target
	if len(target) < 3 || (target[:3] != "CN=" && target[:3] != "cn=") {
		cracked, err := gpdrs.DsCrackNames(rpc, bind.Handle, 7 /* DS_NT4_ACCOUNT_NAME */, 1 /* DS_FQDN_1779_NAME */, []string{c.Domain + "\\" + target})
		if err != nil || len(cracked) == 0 || cracked[0].Name == "" {
			cracked, err = gpdrs.DsCrackNames(rpc, bind.Handle, 11 /* DS_UNIQUE_ID_NAME (SID) */, 1, []string{target})

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Use an account with Domain Admin or 'Replicating Directory Changes (All)' on the domain head
2. Grant the missing ACE explicitly: dsacls 'DC=acme,DC=local' /G acme\\user:CA;'Replicating Directory Changes';
3. Verify DC health: dcdiag on the target
4. Try another DC in the same domain

secret, err := c.DCSync(target)
if err != nil && strings.Contains(err.Error(), "ds bind:") {
    // DC refused the DRS context: almost always rights, retry with elevated account
    return err
}

When it happens

Trigger: gpdrs.DsBind(rpc) returns an error when the authenticated principal cannot open a directory replication context (no 'Replicating Directory Changes' rights), or the DRSUAPI endpoint is present but broken.

Common situations: Using a standard domain user for DCSync; DC in a degraded state (AD replication paused); target is a read-only DC with restrictions.

Related errors

• DsGetNCChanges: %w
• no objectSid found
• smb connect: %w
• open lsass pipe: %w
• drsuapi bind: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/8568e57b36c6fed3. Report an issue: GitHub.