.. /dsdbutil.exe
Star

Dump

Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.

Paths:

Resources:

Acknowledgements:

Detections:

Dump

  1. dsdbutil supports VSS snapshot creation

    dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"
    Use case

    Snapshoting of Active Directory NTDS.dit database

    Privileges required
    Administrator
    Operating systems
    Windows Server 2012, Windows Server 2016, Windows Server 2019
    ATT&CK® technique
    T1003.003

  2. Mounting the snapshot with its GUID

    dsdbutil.exe "activate instance ntds" "snapshot" "mount {GUID}" "quit" "quit"
    Use case

    Mounting the snapshot to access the ntds.dit with copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak

    Privileges required
    Administrator
    Operating systems
    Windows Server 2012, Windows Server 2016, Windows Server 2019
    ATT&CK® technique
    T1003.003

  3. Deletes the mount of the snapshot

    dsdbutil.exe "activate instance ntds" "snapshot" "delete {GUID}" "quit" "quit"
    Use case

    Deletes the snapshot

    Privileges required
    Administrator
    Operating systems
    Windows Server 2012, Windows Server 2016, Windows Server 2019
    ATT&CK® technique
    T1003.003

  4. Mounting with snapshot identifier

    dsdbutil.exe "activate instance ntds" "snapshot" "create" "list all" "mount 1" "quit" "quit"
    Use case

    Mounting the snapshot identifier 1 and accessing it with copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak

    Privileges required
    Administrator
    Operating systems
    Windows Server 2012, Windows Server 2016, Windows Server 2019
    ATT&CK® technique
    T1003.003

  5. Deletes the mount of the snapshot

    dsdbutil.exe "activate instance ntds" "snapshot" "list all" "delete 1" "quit" "quit"
    Use case

    deletes the snapshot

    Privileges required
    Administrator
    Operating systems
    Windows Server 2012, Windows Server 2016, Windows Server 2019
    ATT&CK® technique
    T1003.003