Dumping the contents of ntds.dit files using PowerShell
Dumping ntds.dit file offline using PowerShell
Last updated
Dumping ntds.dit file offline using PowerShell
Last updated
You'll require the https://github.com/MichaelGrafnetter/DSInternals module for this. Instructions on how to install can be found on the github page.
This can be done by exporting the SYSTEM hive using reg.exe
From there you can retrieve the bootkey using Get-BootKey
We then load the DB and decrypt password hashes of all accounts
We can also get a single account by specifying its distinguishedName, objectGuid, objectSid or sAMAccountName atribute:
