During a penetration test for a client, having an infrastructure with multiple (5) Active Directory Servers (Win Serv 2008 R2)... I found a nice exploit to drop a system shell in one of the servers, and stole the domain admin account with mimikatz.
But the problem is, I used quarks-pwdump to dump the hashes... And I am not able to dump all the domain user hashes (most of the LM hashes retrieved are "aad3b435b51404eeaad3b435b51404ee").
I dumped them from the main DC, and a secondary one, both showing the same result. Is there a way to locate the password hashes in the ADs? Is it possible to change the domain configuration to choose the DC on which the hashes are stored ?