Golden ticket attacks do not require network traffic capture or password cracking, as they rely on forging authentication structures using a single static domain key that persists indefinitely.
DCSync abuse requires only read permissions on the directory service replication interface, meaning standard password policies offer no defence against this specific extraction method.
