Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory)

In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015)

The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

* Volume Shadow Copy
* secretsdump.py
* Using the in-built Windows tool, ntdsutil.exe
* Invoke-NinjaCopy

NTDS
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1003/003  external_id: T1003.003     source_name: Metcalf 2015  description: Metcalf, S. (2015, January 19). Attackers Can Now Use Mimikatz to Implant Skeleton Key on Domain Controllers & BackDoor Your Active Directory Forest. Retrieved February 3, 2015.  url: http://adsecurity.org/?p=1275     source_name: Wikipedia Active Directory  description: Wikipedia. (2018, March 10). Active Directory. Retrieved April 11, 2018.  url: https://en.wikipedia.org/wiki/Active_Directory     