NTDS.dit — Active Directory Database
Ctrl+F:
NTDS.dit·NTDS·NT Directory Services·AD database·C:\Windows\NTDS·/etc/shadowequivalent
External: Internal All The Things — NTDS Dumping
NTDS.dit is the Active Directory database.
If you only remember one thing, remember this:
NTDS.ditis to Active Directory what/etc/shadowis to Linux—but much bigger and much more important.
It contains nearly everything the Domain Controller knows about the domain.
What does NTDS stand for?
NT Directory Services
The file is typically located at:
C:\Windows\NTDS\ntds.dit
It is a Microsoft Extensible Storage Engine (ESE) database.
Linux vs Windows — where hashes live
| Store | Platform | Path | Contents |
|---|---|---|---|
/etc/shadow | Linux | /etc/shadow | Local password hashes |
| SAM | Windows (local) | C:\Windows\System32\config\SAM | Local users + NTLM hashes |
| NTDS.dit | Windows (domain) | C:\Windows\NTDS\ntds.dit | All domain users, groups, computers, GPO metadata, etc. |
Local workstation → dump SAM + SYSTEM. Domain Controller → dump NTDS.dit + SYSTEM (not SAM for domain accounts).
→ Registry Hives and Linux Equivalents
What’s inside (OSCP-relevant)
- Domain user NTLM hashes (and often Kerberos keys)
- Computer accounts
- Group membership
- OU structure
- Much of AD object data
Locked while DC runs — cannot copy directly; use VSS shadow copy, nxc backup_operator, DCSync, or backup privileges.
How to dump & parse (quick map)
| Method | When | Note |
|---|---|---|
nxc -M backup_operator | SeBackupPrivilege + creds on Kali | SeBackupPrivilege |
| diskshadow + robocopy /b | On-box evil-winrm shell | diskshadow · robocopy |
impacket-secretsdump remote | Admin/DA creds on DC | secretsdump |
| DCSync | Replicating privileges (not file copy) | Mimikatz · secretsdump |
| wbadmin + SMB | SeBackup + SeRestore | SeBackupPrivilege > 📌 6) Method 5 — wbadmin + SMB share (SeBackup + SeRestore) |
Always need SYSTEM hive with offline NTDS parse:
impacket-secretsdump LOCAL -system SYSTEM -security SECURITY -ntds ntds.dit
secretsdump.py LOCAL -system SYSTEM -security SECURITY -ntds ntds.dit
impacket-secretsdump -system system -security SECURITY -ntds ntds.dit LOCAL -just-dc-ntlm
impacket-secretsdump -system system -ntds ntds.dit LOCALAfter dump → Credential Graph · PtH · spray · hunt DA.
OSCP mental model
Linux domain? → /etc/passwd + /etc/shadow (local only)
Windows workstation → SAM + SYSTEM
Windows DC (AD) → NTDS.dit + SYSTEM ← entire domain hash database