Mimikatz creates a new server and nTDSDSA objects in the Active Directory forest Configuration partition. Next, it updates the SPN (Service Principal Name) of the computer hosting the rogue domain controller to “GC” (Global Catalog) and “E3514235-4B06-11D1-AB04-00C04FC2DCD2” (Active Directory Replication). The rogue domain controller is now registered and capable of replicating data to other domain controllers.