-
Extracting Password Hashes from the Ntds.dit File | Insider Threat Blog
October 22, 2019 at 10:12:00 AM UTC - permalink -- Use Volume Shadow Copies via the VSSAdmin command
- Leverage the NTDSUtil diagnostic tool available as part of Active Directory
- Use the PowerSploit penetration testing PowerShell
- Leverage snapshots if your Domain Controllers are running as virtual machines
secretsdump.py (Impacket)
- https://blog.stealthbits.com/extracting-password-hashes-from-the-ntds-dit-file/