ad.group_policies

$ target-query <path/to/target> -f ad.group_policies
Details

Module

dissect.target.plugins.os.windows.ad.ntds.NtdsPlugin

Output

records

Module documentation

Plugin to parse NTDS.dit Active Directory database and extract user credentials.

This plugin extracts user password hashes, password history, Kerberos keys, and other authentication data from the NTDS.dit database found on Windows Domain Controllers.

Function documentation

Extract all group policy objects (GPO) NTDS.dit database.