Parse an offline domain database or select a justified remote collection path
Needs: Matched NTDS/SYSTEM for offline parsing, or the specific remote protocol/host/replication rights required by the chosen method
Offline NTDS from an already controlled DC
# Offline NTDS from an already controlled DC
impacket-secretsdump -ntds NTDS.dit -system SYSTEM.hive LOCAL
Obtaining locked DC database files normally requires DC-level privilege and a snapshot/backup-aware method. Ordinary local administrator on a member server does not provide this material.
Shadow-copy boundary: inspect before creating anything
REM Shadow-copy boundary: inspect before creating anything
whoami /priv
vssadmin list shadows
diskshadow
At the DISKSHADOW> prompt
# At the DISKSHADOW> prompt
list shadows all
exit
Interpret: an existing shadow proves only a snapshot object. It does not prove the current identity can read
NTDS.dit, that the copy is current, or that a matching SYSTEM hive has been acquired.DiskShadowis a Windows Server utility; absence on a workstation is a platform result, not proof that VSS does not exist.
Creating, exposing or deleting a shadow changes host state and normally requires elevated backup/administrator context. Do not offer those actions until the selected procedure records the exact volume, matched NTDS/SYSTEM acquisition, destination, verification and cleanup. The state-machine gap is tracked as
RW08; listing is safe discovery, not credential acquisition.
Remote collection
# Remote collection
impacket-secretsdump -dc-ip DC_IP 'DOMAIN/USER:PASSWORD@DC_HOST'
# Remote collection
impacket-secretsdump -hashes :NT_HASH -dc-ip DC_IP 'DOMAIN/USER@DC_HOST'
This broad form can invoke several remote collection paths and is high impact. Use it only when the lab objective and privileges justify those sources. For replication rights and a bounded one-user request, use DCSync.
Verify → Verify source consistency, account mapping and the exact collection method; retain sensitive output privately.
If it fails → DC reachability or local administrator access on a member server is not sufficient for domain replication. More detail ↓
Explanation & examples
Parse an offline domain database or select a justified remote collection path
- USE WHEN
- An already controlled DC or a validated privileged domain collection context
- STARTING ACCESS
- A domain identity, appropriate host privilege, or a validated effective directory-object right
- RESULT
- Domain credential material with a recorded source and collection mechanism
Recognize the clue
Start only from evidence of an already controlled DC or a domain replication right; identify the source mechanism before choosing a generic extraction command.
file NTDS.dit SYSTEM.save
NTDS.dit: database artifact
SYSTEM.save: registry artifact
Same DC/consistent snapshot: must be verifiedMeans: A database/key pair is an offline source candidate; remote DRS requires a different permission chain.
Confirm: Verify same-source consistency and access, or independently validate the exact replication/remote collection prerequisites.
- After validation
- The consistent offline pair parses into account-labelled material: choose classification/reuse.
- Ruled out in this context
- Only administrator access on a member server exists: reject the assumed domain-database/replication access.
- Still inconclusive
- Two filenames without provenance do not prove a matched usable source.
Troubleshooting: DC reachability or local administrator access on a member server is not sufficient for domain replication.
Offline NTDS from an already controlled DC
An offline parse needs a matched NTDS.dit and SYSTEM hive:
Obtaining locked DC database files normally requires DC-level privilege and a snapshot/backup-aware method. Ordinary local administrator on a member server does not provide this material.
Shadow-copy boundary: inspect before creating anything
From an already controlled Windows Server/DC context, first determine whether a usable snapshot already exists and whether the current token has the required backup/administrative rights:
At the DISKSHADOW> prompt:
Interpret: an existing shadow proves only a snapshot object. It does not prove the current identity can read
NTDS.dit, that the copy is current, or that a matching SYSTEM hive has been acquired.DiskShadowis a Windows Server utility; absence on a workstation is a platform result, not proof that VSS does not exist.
Creating, exposing or deleting a shadow changes host state and normally requires elevated backup/administrator context. Do not offer those actions until the selected procedure records the exact volume, matched NTDS/SYSTEM acquisition, destination, verification and cleanup. The state-machine gap is tracked as RW08; listing is safe discovery, not credential acquisition.
Remote collection
This broad form can invoke several remote collection paths and is high impact. Use it only when the lab objective and privileges justify those sources. For replication rights and a bounded one-user request, use DCSync.
Why it works
Offline database parsing and DRS replication are different mechanisms. A generic remote extraction command can try multiple methods; select only the source whose prerequisites have been taught and verified.
Worked example · hypothetical
Observation: an already controlled DC provides a consistent database/key pair. Test: parse the matched source offline. Illustrative output: domain-account hashes are recovered. Interpretation: classify identities and perform the smallest relevant verification.
New identity, privilege, host or route? Re-enumerate → All topic tasks →