Confirmation that DCSync really requires both "DS-Replication-Get-Changes" and "DS-Replication-Get-Changes-All" extended rights
The "ERROR_DS_DRA_BAD_DN" error code is a bit misleading though! pic.twitter.com/nb6DXmANCq

— Clément Notin (@cnotin) July 27, 2021