Active_Directory_Identity_Defense / DCSync_Replication_Investigation · size 20 · threshold 4 · max attempts 3