WriteDaclover another object.
DS-Replication-Get-Changes-All). Giving full control leads to the same thingsince
ExtendedRights, hence the two extended rights needed for DCSync to work.
WriteDaclover domain objects, allowing attackers to conduct a PrivExchange attack where control would be gained over an Exchange Server which would then be used to grant an attacker-controlled object DCSync privileges to the domain.