I am working with an extremely large NTDS.DIT file. It is about 20gb.
Originally, I was attempting to dump all of the hashes from the NTDS.DIT file. I tried using meterpreter domain hash dump, smart hash dump, and just simply hash dump on the domain controller. Each time, I received errors from Meterpreter.
Once I ran into this, I used the shadow copy trick and got a copy of the NTDS.DIT file, and began to extract all of the hashes (using libesedb and NTDSextract). However, it has been almost a week, and even though libexedbexport is still running, I am hoping I can get some information quicker than 3 weeks (currently on pace for 3 weeks).
So my next step is trying to extract individual records based on username. I've done some googling, but I haven't been able to find any method of extracting just one or several hashes more quickly.
Is this possible? Is there an application that I can use to do this? Any help would be appreciated.