SYSVOL replication is done over SSH tunnels using the Kerberos credentials of a proxy user that is set up and managed internally. The credentials are accessible only to the local root user.