NTDS.dit
NTDS.dit (C:\Windows\NTDS\ntds.dit) is the Active Directory database — the
file where a domain controller stores the entire domain partition: users,
groups, computers, and — the part attackers care about — password material
(NT hashes, Kerberos keys, and password history) for every account in the
domain. Each DC in a domain carries its own copy and keeps it consistent with
peers via the DRSUAPI (MS-DRSR) replication protocol, so a write on
one DC propagates to the rest.
Because the file is locked by the AD service while the DC is running, grabbing it requires one of three broad approaches:
| Approach | Mechanism |
|---|---|
| DCSync | Ask the DC to replicate the secrets to you over MS-DRSR — no file access needed. Requires replication rights (DA-equivalent). See drsuapi. |
| Volume Shadow Copy | Snapshot the volume (vssadmin create shadow), then copy ntds.dit from the snapshot. Needs local admin on the DC. |
| IFM / backup media | ntdsutil "ac in ntds" "ifm" ... produces an Install From Media copy, or lift the file from DC backups. |
The database is ESE (Extensible Storage Engine) format; raw file in hand, you
still need the SYSTEM registry hive from the same DC — its boot key decrypts
the per-column encryption on the secret attributes. Tools that pair the two
(secretsdump.py, ntdsutil + esentutl, Mimikatz lsadump::dcsync /offline)
recover every account’s NT hash and Kerberos keys — including krbtgt, which is
everything needed for golden tickets, and
every user hash for pass-the-hash / offline cracking.
MITRE: T1003.003 — OS Credential Dumping: NTDS.
Related
- drsuapi — the replication protocol DCSync abuses; the other half of this story
- golden-and-silver-ticket-attacks — what a stolen
krbtgtbuys - active-directory-domains-trees-forests — each DC holds its domain’s full copy