I'm looking at hardening our AD. One concern I have is around Golden Ticket Attacks using Mimikatz and the likes (https://attack.stealthbits.com/how-golden-ticket-attack-works). One of the things that struck me about the attack is that it requires privileges on a DC. If you already have privileges on a DC, what's the point of the attack, why not just create a new domain admin?
What I am missing?