User activity
NTDS.dit and domain controllers
NTDS.dit cheat sheet: the Active Directory database, what it proves, theft traces on a DC, and the Kerberos, NTLM and DCSync event IDs investigators need.
- Location
- C:\Windows\NTDS\ntds.dit
- Proves
- Domain accounts, group membership, password history and (offline) every domain hash
- Timestamps
- AD attributes (pwdLastSet, lastLogonTimestamp) in FILETIME UTC; replication caveats; ESENT log times in the Application log
- Retention
- Live on every DC until objects are deleted (then tombstoned); IFM snapshots and shadow copies persist until removed
- Access
- SYSTEM on a DC to read the locked live file; the SYSTEM hive boot key is required to decrypt hashes offline
- Evidence of
- User activityNetwork & remote access
- Type
- Database
- Windows
- Vista / 78 / 8.11011
- KAPE target
- No dedicated target
- Velociraptor
- No dedicated target
Tools
Compare all tools- SecretsDumpIn browser
- EVTX ParserIn browser
- Registry ParserIn browser
- impacketCLI · open source
- DSInternalsLibrary · open source
- ntdsutilCLI · built into Windows
- libesedbLibrary · open source
- SecretsDump: For authorized incident response only.
What it is
ntds.dit is the Active Directory database: an ESE (Extensible Storage Engine) database on every domain controller that holds every domain user, computer and group, their attributes, and the (encrypted) password hashes and password history. It is the single richest target in a domain and the ultimate prize of most intrusions, because dumping it yields credentials for the entire directory. For investigators it is both an evidence source (who existed, who belonged to what, when passwords changed) and, when copied off a DC, a sign that mass credential theft may have occurred.
Location
| Item | Path |
|---|---|
| Database | C:\Windows\NTDS\ntds.dit |
| Transaction logs | C:\Windows\NTDS\edb.log, edbNNNNN.log, edb.chk |
| Boot key source | SYSTEM hive (C:\Windows\System32\config\SYSTEM) |
| Directory Service log | Directory Service event channel |
The live file is locked by the NTDS service. Offline decryption of hashes requires the boot key from the SYSTEM registry hive captured from the same DC.
What it proves
- Accounts and membership: which domain accounts and groups exist, nesting, and privileged group membership (Domain Admins, Enterprise Admins).
- Password timeline:
pwdLastSetshows when a password was last changed; password history hashes reveal reuse. - Hashes for offline cracking or pass-the-hash, only with the boot key.
- It does not cleanly prove last logon.
lastLogonTimestampis replicated only within a tolerance window (default 14 days), so it is approximate; the preciselastLogonattribute is non-replicated and differs per DC. Do not treat either as an exact interactive-logon time.
Key fields
| Attribute | Meaning |
|---|---|
sAMAccountName / objectSid | Account name and SID |
pwdLastSet | Last password change (FILETIME) |
lastLogonTimestamp | Approximate last logon, replicated (caveat above) |
userAccountControl | Flags: disabled, no-password, delegation |
memberOf / member | Group membership |
| unicodePwd / ntPwdHistory | Encrypted current hash and history |
Timestamps
AD attribute times are FILETIME in UTC. Beyond the replication caveats above, note whenCreated / whenChanged on objects and, for theft investigations, the ESENT events written to the Application log when the database is copied or snapshotted.
Retention and clearing
The database lives on every DC until an object is deleted, after which it is tombstoned (recoverable for the tombstone lifetime) then removed. Attacker IFM (Install From Media) snapshots and volume shadow copies created to grab the file persist on disk until cleaned up and are prime recovery targets.
Collection
Never copy the live locked file directly. Use a shadow copy or the vendor tooling, and always capture the SYSTEM hive alongside it.
ntdsutil "activate instance ntds" "ifm" "create full C:\case\ntds" quit quit
reg save HKLM\SYSTEM C:\case\ntds\SYSTEM
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL
The same ntdsutil ifm and vssadmin create shadow commands are also how attackers stage the theft, so seeing them in history is significant.
Parsing tools
- impacket
secretsdump.py(open source): parsesntds.dit+ SYSTEM offline and, against a live DC, performs DCSync via replication. Named factually for defenders. - DSInternals (PowerShell, open source):
Get-ADDBAccountreads accounts, hashes and history from an offline database for auditing. - libesedb /
esedbexport(Joachim Metz, open source): dumps the raw ESE tables. - ntdsutil (built in): creates the IFM snapshot for legitimate collection.
Investigation tips
- Theft traces on the DC:
ntdsutil ... ifmsnapshots,vssadmin create shadow, and ESENT event IDs 325/326/327 (database create/attach/detach) in the Application log around the incident window. Correlate with process creation and PowerShell logs. - DCSync detection: Security 4662 on a DC with the replication GUIDs
1131f6aa-9c07-11d1-f79f-00c04fc2dcd2(DS-Replication-Get-Changes) or1131f6ad-...(All), triggered by a non-DC account, is the classic DCSync signature. - DC-side authentication events: Kerberos 4768 (TGT), 4769 (service ticket), 4771 (pre-auth failure); NTLM 4776; 4624/4625 logons. These exist only on DCs for domain auth and are essential for lateral movement reconstruction.
- Directory changes: 5136 (object modified) and 5137 (object created) in the Security log, plus the Directory Service channel, catch privilege escalation such as adding an account to Domain Admins; correlate with 4728/4732/4756 (group additions) and 4720/4738 (account create/change).
- Compare
pwdLastSetclusters: many accounts changed in a short window can indicate a mass reset during remediation or an attacker resetting service accounts.
Related artifacts
- SAM hive and user accountsSAM hive cheat sheet: local accounts, RIDs, last logon and password change times, logon counts, group membership, ProfileList, and account-related event IDs.
- Windows event logs (EVTX)Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- Volume Shadow Copies (VSS)Volume Shadow Copies cheat sheet: store files in System Volume Information, copy-on-write blocks, deletion by ransomware, mounting and parsing.
- Registry hivesRegistry hives cheat sheet: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat, transaction logs, RegBack, LastWrite times and collection.
- DPAPI and Credential ManagerDPAPI and Credential Manager cheat sheet: master keys, Windows Vault, what secrets they hold, offline decryption requirements and credential-theft traces.
- Group Policy artifactsGroup Policy cheat sheet: SYSVOL policies, Registry.pol, GPP passwords, client-side history and event logs, and how attackers abuse GPO for mass deployment.
Glossary terms
- Security Identifier (SID)The unique value Windows uses to identify users, groups and computers, such as S-1-5-21-…-1001, found throughout registry, logs and file paths.
- ESE database (Extensible Storage Engine)Microsoft's embedded transactional database format behind SRUM, WebCache, the Windows Search index and the BITS queue, often found dirty.
- Lateral movementAn attacker moving from one compromised host to others in the network, using RDP, SMB, PsExec, WMI, WinRM or remote tasks and services.
- Windows event IDThe number identifying an event type within a given provider; it only has meaning when paired with its provider and log channel.
Guides
- Windows Event Log Forensics: EVTX, Event IDs and HuntingA practitioner guide to Windows event logs: EVTX format, key channels, Security and Sysmon event IDs, audit policy, cleared-log recovery and hunting tools.
- Lateral Movement Forensics: RDP, PsExec, WMI and WinRMMap source and destination artifacts for RDP, PsExec, SMB, WMI, WinRM, scheduled tasks and DCOM, then build a cross-host lateral movement graph.
- Credential Access Forensics: LSASS, DCSync and KerberoastingInvestigate Windows credential theft: LSASS dumps, SAM and NTDS.dit extraction, DCSync, DPAPI, Kerberoasting and AS-REP roasting, with event IDs and ATT&CK.
- Active Directory Forensics: Domain Controller Event LogsInvestigate domain controllers: Kerberos and NTLM events, account and group changes, DCSync 4662, directory changes, GPO abuse, NTDS.dit theft, forged tickets.