ad

$ target-query <path/to/target> -f ad

Details

Module	dissect.target.plugins.os.windows.ad.ntds.NtdsPlugin
Output	records

Module documentation

Plugin to parse NTDS.dit Active Directory database and extract user credentials.

This plugin extracts user password hashes, password history, Kerberos keys, and other authentication data from the NTDS.dit database found on Windows Domain Controllers.

Function documentation

This is a namespace plugin. This means that by running this plugin, it will automatically run all other plugins under this namespace:

• ad.computers

• ad.group_policies

• ad.users