If I understand correctly,
hashdump dumps the content of the SAM file. Domain users should be in the AD database on domain controllers, which I understand is NTDS.dit .
On my test network, if I run
hashdump on a domain joined workstation I don't get any domain users as expected.
However on my domain controller, running
hashdump appears to also dump my domain users.
Why would people bother fetching NTDS.dit and using extraction tools like
dsusers when they can just
I fear I'm missing something. Could someone explain more clearly if
hashdump on a DC does indeed dump all domain accounts and hashes, and what the difference is between that and extracting them from NTDS.dit?