DCSync attack — how it works, why it’s dangerous, and how to stop it

Imagine an attacker who never needs to touch a Domain Controller’s disk, never needs to “dump” NTDS.dit, and yet walks away with password…