Add-ADDBSidHistory Add ADDBSidHistory Adds one or more values to the sIDHistory attribute of an object in a ntds.dit file. > [!WARNING] > This cmdlet has been removed from the DSInternals PowerShell module. > Information in this topic is provided for reference purposes only. This cmdlet can be used to add any value to the sIDHistory attribute by directly modifying the Active Directory database. Note that the Active Directory Migration Tool (ADMT) is the only supported way of modifying the sIDHistory attribute. Improper usage of this cmdlet may cause irreversible damage to the target Active Directory environment. Add-ADDBSidHistory DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an object on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None SidHistory Specifies an array of security IDs (SIDs) that will be added to the SID History of the target object. SecurityIdentifier[] SecurityIdentifier[] None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Add-ADDBSidHistory DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an object on which to perform this operation. Guid Guid None SidHistory Specifies an array of security IDs (SIDs) that will be added to the SID History of the target object. SecurityIdentifier[] SecurityIdentifier[] None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Add-ADDBSidHistory DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectSid Specifies the identifier of an object on which to perform this operation. SecurityIdentifier SecurityIdentifier None SidHistory Specifies an array of security IDs (SIDs) that will be added to the SID History of the target object. SecurityIdentifier[] SecurityIdentifier[] None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Add-ADDBSidHistory SamAccountName Specifies the identifier of an object on which to perform this operation. String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None SidHistory Specifies an array of security IDs (SIDs) that will be added to the SID History of the target object. SecurityIdentifier[] SecurityIdentifier[] None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an object on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an object on which to perform this operation. Guid Guid None ObjectSid Specifies the identifier of an object on which to perform this operation. SecurityIdentifier SecurityIdentifier None SamAccountName Specifies the identifier of an object on which to perform this operation. String String None SidHistory Specifies an array of security IDs (SIDs) that will be added to the SID History of the target object. SecurityIdentifier[] SecurityIdentifier[] None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter SwitchParameter False System.Security.Principal.SecurityIdentifier[] System.String System.Security.Principal.SecurityIdentifier System.Guid None -------------------------- Example 1 -------------------------- PS C:\> Stop-Service -Name ntds -Force PS C:\> Add-ADDBSidHistory -SamAccountName John ` -SidHistory 'S-1-5-21-3623811102-3361044346-30300840-512', 'S-1-5-21-3623811102-3361044346-30300840-519' ` -DatabasePath C:\Windows\NTDS\ntds.dit PS C:\> Start-Service -Name ntds Adds the SIDs of the Domain Admins and Enterprise Admins groups into user John 's sIDHistory. -------------------------- Example 2 -------------------------- PS C:\> Import-Csv user.csv | Add-ADDBSidHistory -DatabasePath C:\Windows\NTDS\ntds.dit Imports a CSV file containing SamAccountName and SidHistory columns into a nds.dit file. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Add-ADDBSidHistory.md Set-ADDBPrimaryGroup Get-ADDBAccount Get-ADDBDomainController Add-ADReplNgcKey Add ADReplNgcKey Composes and updates the msDS-KeyCredentialLink value on an object through the MS-DRSR protocol. This cmdlet wraps the IDL_DRSWriteNgcKey RPC call. Add-ADReplNgcKey DistinguishedName Specifies the identifier of the target Active Directory object. String String None Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None PublicKey Specifies the NGC key value. Byte[] Byte[] None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Add-ADReplNgcKey SamAccountName Specifies the identifier of the target Active Directory account. String String None Domain Specifies the NetBIOS domain name of the target Active Directory account. String String None Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None PublicKey Specifies the NGC key value. Byte[] Byte[] None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Add-ADReplNgcKey Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None ObjectGuid Specifies the identifier of the target Active Directory object. Guid Guid None PublicKey Specifies the NGC key value. Byte[] Byte[] None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Add-ADReplNgcKey Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None ObjectSid Specifies the identifier of the target Active Directory account. SecurityIdentifier SecurityIdentifier None PublicKey Specifies the NGC key value. Byte[] Byte[] None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Add-ADReplNgcKey Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None PublicKey Specifies the NGC key value. Byte[] Byte[] None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None UserPrincipalName Specifies the identifier of the target Active Directory account. String String None Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None DistinguishedName Specifies the identifier of the target Active Directory object. String String None Domain Specifies the NetBIOS domain name of the target Active Directory account. String String None ObjectGuid Specifies the identifier of the target Active Directory object. Guid Guid None ObjectSid Specifies the identifier of the target Active Directory account. SecurityIdentifier SecurityIdentifier None PublicKey Specifies the NGC key value. Byte[] Byte[] None SamAccountName Specifies the identifier of the target Active Directory account. String String None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None UserPrincipalName Specifies the identifier of the target Active Directory account. String String None System.String System.Security.Principal.SecurityIdentifier System.Guid None -------------------------- Example 1 -------------------------- PS C:\> Add-ADReplNgcKey -UserPrincipalName 'john@contoso.com' -Server LON-DC1 -PublicKey 525341310008000003000000000100000000000000000000010001C1A78914457758B0B13C70C710C7F8548F3F9ED56AD4640B6E6A112655C98ECAC1CBD68A298F5686C08439428A97FE6FDF58D78EA481905182BAD684C2D9C5CDE1CDE34AA19742E8BBF58B953EAC4C562FCF598CC176B02DBE9FFFEF5937A65815C236F92892F7E511A1FEDD5483CB33F1EA715D68106180DED2432A293367114A6E325E62F93F73D7ECE4B6A2BCDB829D95C8645C3073B94BA7CB7515CD29042F0967201C6E24A77821E92A6C756DF79841ACBAAE11D90CA03B9FCD24EF9E304B5D35248A7BD70557399960277058AE3E99C7C7E2284858B7BF8B08CDD286964186A50A7FCBCC6A24F00FEE5B9698BBD3B1AEAD0CE81FEA461C0ABD716843A5 Registers the specified NGC public key for user john@contoso.com . Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Add-ADReplNgcKey.md Get-ADReplAccount Get-ADKeyCredential Add-ADReplSidHistory Add ADReplSidHistory Adds SID history from a source principal to a destination principal through the MS-DRSR protocol. This cmdlet wraps the IDL_DRSAddSidHistory RPC call. It passes source and destination principal information to the domain controller and can optionally validate the secure channel or delete the source object. Add-ADReplSidHistory CheckSecureChannel Verifies whether the channel is secure and returns the result of the verification. SwitchParameter False Credential Specifies a user account that has permission to connect to the destination domain controller. The default is the current user. PSCredential PSCredential None Server Specifies the target domain controller for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. String String None Add-ADReplSidHistory Credential Specifies a user account that has permission to connect to the destination domain controller. The default is the current user. PSCredential PSCredential None DeleteSourceObject Appends the source object's SID history to the destination and deletes the source object from the source domain. SwitchParameter False DestinationPrincipal Specifies the destination security principal that receives the source SID history. String String None Server Specifies the target domain controller for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. String String None SourcePrincipal Specifies the source security principal whose SID history is to be added. If -DeleteSourceObject is specified, this value should be a DN; otherwise, it should be a domain-relative SAM name. String String None Add-ADReplSidHistory Credential Specifies a user account that has permission to connect to the destination domain controller. The default is the current user. PSCredential PSCredential None DestinationDomain Specifies the destination domain in which the destination principal resides. The domain name can be an FQDN or a NetBIOS name. String String None DestinationPrincipal Specifies the destination security principal that receives the source SID history. String String None Server Specifies the target domain controller for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. String String None SourceCredential Specifies the credentials to be used in the source domain. PSCredential PSCredential None SourceDomain Specifies the source domain to query for the SID of the source principal. The domain name can be an FQDN or a NetBIOS name. String String None SourceDomainController Specifies the primary domain controller (PDC) or PDC role owner in the source domain. String String None SourcePrincipal Specifies the source security principal whose SID history is to be added. If -DeleteSourceObject is specified, this value should be a DN; otherwise, it should be a domain-relative SAM name. String String None CheckSecureChannel Verifies whether the channel is secure and returns the result of the verification. SwitchParameter SwitchParameter False Credential Specifies a user account that has permission to connect to the destination domain controller. The default is the current user. PSCredential PSCredential None DeleteSourceObject Appends the source object's SID history to the destination and deletes the source object from the source domain. SwitchParameter SwitchParameter False DestinationDomain Specifies the destination domain in which the destination principal resides. The domain name can be an FQDN or a NetBIOS name. String String None DestinationPrincipal Specifies the destination security principal that receives the source SID history. String String None Server Specifies the target domain controller for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. String String None SourceCredential Specifies the credentials to be used in the source domain. PSCredential PSCredential None SourceDomain Specifies the source domain to query for the SID of the source principal. The domain name can be an FQDN or a NetBIOS name. String String None SourceDomainController Specifies the primary domain controller (PDC) or PDC role owner in the source domain. String String None SourcePrincipal Specifies the source security principal whose SID history is to be added. If -DeleteSourceObject is specified, this value should be a DN; otherwise, it should be a domain-relative SAM name. String String None System.String None -------------------------- Example 1 -------------------------- PS C:\> Add-ADReplSidHistory -SourceDomain 'CONTOSO' -SourcePrincipal 'LegacyUser' -SourceDomainController 'CONTOSO-PDC' -SourceCredential (Get-Credential 'CONTOSO\Administrator') -DestinationDomain 'FABRIKAM' -DestinationPrincipal 'MigratedUser' -Server 'FABRIKAM-DC1' Adds the SID history of LegacyUser from the CONTOSO domain to MigratedUser in the FABRIKAM domain. -------------------------- Example 2 -------------------------- PS C:\> Add-ADReplSidHistory -SourcePrincipal 'CN=LegacyUser,CN=Users,DC=contoso,DC=com' -DestinationPrincipal 'CN=MigratedUser,CN=Users,DC=contoso,DC=com' -DeleteSourceObject -Server 'CONTOSO-DC1' Adds the SID history of the source object to the destination object in the same domain and deletes the source object. -------------------------- Example 3 -------------------------- PS C:\> Add-ADReplSidHistory -CheckSecureChannel -Server 'FABRIKAM-DC1' Verifies that the RPC connection to the destination DC is secure. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Add-ADReplSidHistory.md Clear-DpapiNgSidKeyCache Clear DpapiNgSidKeyCache Deletes all KDS root key derived DPAPI-NG group keys cached on the local machine by the current user. This cmdlet purges the calling user's local DPAPI-NG SID key cache by invoking the `kdscli!DeleteAllCachedKeys` API. After the cache is cleared, subsequent DPAPI-NG decryption operations will need to re-derive the required group keys from the corresponding KDS root keys, either by contacting a domain controller or by re-seeding the cache with `Save-DpapiNgSidKey`. This is typically useful when testing offline DPAPI-NG recovery scenarios, where stale cached keys would otherwise mask the effect of newly seeded keys. Clear-DpapiNgSidKeyCache Confirm Prompts you for confirmation before running the cmdlet. SwitchParameter False WhatIf Shows what would happen if the cmdlet runs. The cmdlet is not run. SwitchParameter False Confirm Prompts you for confirmation before running the cmdlet. SwitchParameter SwitchParameter False WhatIf Shows what would happen if the cmdlet runs. The cmdlet is not run. SwitchParameter SwitchParameter False None None Aliases: `Remove-DpapiNgSidKey`, `Clear-CngDpapiSidKeyCache`, `Remove-CngDpapiSidKey` -------------------------- Example 1 -------------------------- PS C:\> Clear-DpapiNgSidKeyCache Deletes all cached KDS root key derived DPAPI-NG group keys for the current user, prompting for confirmation. -------------------------- Example 2 -------------------------- PS C:\> Clear-DpapiNgSidKeyCache -Confirm:$false Deletes all cached KDS root key derived DPAPI-NG group keys without prompting. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Clear-DpapiNgSidKeyCache.md Save-DpapiNgSidKey Get-DpapiNgSidKeyIdentifier Unprotect-DpapiNgData Unprotect-DpapiNgPfxCertificate ConvertFrom-ADManagedPasswordBlob ConvertFrom ADManagedPasswordBlob Decodes the value of the msDS-ManagedPassword attribute of a Group Managed Service Account. Decodes the MSDS-MANAGEDPASSWORD_BLOB structure containing a group-managed service account's password information. The password is actually a cryptographically generated array of 256 bytes that is represented as an 128 characters long UTF-16 string. ConvertFrom-ADManagedPasswordBlob Blob Specifies the binary value stored in the msDS-ManagedPassword attribute. Byte[] Byte[] None Blob Specifies the binary value stored in the msDS-ManagedPassword attribute. Byte[] Byte[] None None DSInternals.Common.Data.ManagedPassword -------------------------- Example 1 -------------------------- PS C:\> $gmsa = Get-ADServiceAccount -Identity 'SQL_HQ_Primary' -Properties 'msDS-ManagedPassword' PS C:\> ConvertFrom-ADManagedPasswordBlob -Blob $gmsa.'msDS-ManagedPassword' <# Sample Output: Version : 1 CurrentPassword : 湤ୟɰ橣낔饔ᦺ几᧾ʞꈠ⿕ՔὬ랭뷾햾咶郸�렇ͧ퀟᝘럓몚ꬶ佩䎖∘Ǐ㦗ן뱷鼹⽩Ⲃ⫝咽㠅Ｅ䠹鸞왶婰鞪 PreviousPassword : QueryPasswordInterval : 29.17:15:36.3736817 UnchangedPasswordInterval : 29.17:10:36.3736817 #> Decodes the managed password information from a group-managed service account (GMSA) called SQL_HQ_Primary . The user retrieving the managed password needs to be listed in the PrincipalsAllowedToRetrieveManagedPassword property of the GMSA. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/ConvertFrom-ADManagedPasswordBlob.md Get-ADServiceAccount https://docs.microsoft.com/en-us/powershell/module/addsadministration/get-adserviceaccount Set-ADServiceAccount https://docs.microsoft.com/en-us/powershell/module/addsadministration/set-adserviceaccount New-ADServiceAccount https://docs.microsoft.com/en-us/powershell/module/addsadministration/new-adserviceaccount ConvertFrom-GPPrefPassword ConvertFrom GPPrefPassword Decodes a password from the format used by Group Policy Preferences. Decrypts a password that was encrypted using Group Policy Preferences (GPP). GPP stored passwords in SYSVOL using AES encryption with a key that Microsoft published in MSDN documentation. This vulnerability (MS14-025) allows anyone with access to SYSVOL to decrypt these passwords. This cmdlet can be used to audit GPP XML files for exposed credentials. ConvertFrom-GPPrefPassword EncryptedPassword Provide an encrypted password from a Group Policy Preferences XML file. String String None EncryptedPassword Provide an encrypted password from a Group Policy Preferences XML file. String String None System.String System.String -------------------------- Example 1 -------------------------- PS C:\> ConvertFrom-GPPrefPassword -EncryptedPassword 'v9NWtCCOKEUHkZBxakMd6HLzo4+DzuizXP83EaImqF8' <# Sample Output: Pa$$w0rd #> Decrypts a password from a Group Policy Preferences XML file (e.g., Groups.xml, ScheduledTasks.xml, or Drives.xml) and returns the cleartext password. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/ConvertFrom-GPPrefPassword.md ConvertFrom-UnicodePassword ConvertFrom UnicodePassword Decodes a password from the format used in unattend.xml files. Decodes a Base64-encoded Unicode password from the format used in Windows unattend.xml files. This is useful for recovering or auditing passwords that have been stored in unattend.xml configuration files used during automated Windows deployments. ConvertFrom-UnicodePassword UnicodePassword Specifies the encoded password that should be decoded. String String None UnicodePassword Specifies the encoded password that should be decoded. String String None None System.String -------------------------- Example 1 -------------------------- PS C:\> ConvertFrom-UnicodePassword -UnicodePassword 'UABhAHMAcwB3ADAAcgBkAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA==' <# Sample Output: Passw0rd #> Decodes a Base64-encoded password from an unattend.xml file and returns the cleartext password. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/ConvertFrom-UnicodePassword.md ConvertTo-GPPrefPassword ConvertTo GPPrefPassword Converts a password to the format used by Group Policy Preferences. Encrypts a password using the AES key that was used by Group Policy Preferences (GPP) to store passwords in SYSVOL. This encryption method is considered insecure because Microsoft published the AES key in MSDN documentation (MS14-025). This cmdlet is provided for educational and testing purposes. ConvertTo-GPPrefPassword Password Provide a password in the form of a SecureString. SecureString SecureString None Password Provide a password in the form of a SecureString. SecureString SecureString None System.Security.SecureString System.String -------------------------- Example 1 -------------------------- PS C:\> $password = Read-Host -AsSecureString -Prompt 'Enter password' PS C:\> ConvertTo-GPPrefPassword -Password $password <# Sample Output: v9NWtCCOKEUHkZBxakMd6HLzo4+DzuizXP83EaImqF8 #> Encrypts a password using the well-known Group Policy Preferences AES key and returns the Base64-encoded ciphertext. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/ConvertTo-GPPrefPassword.md ConvertTo-Hex ConvertTo Hex Helper cmdlet that converts binary input to a hexadecimal string. Converts a byte array to its hexadecimal representation. ConvertTo-Hex Input Specifies the binary input in the form of an array of bytes. Byte[] Byte[] None UpperCase Indicates that the output should be encoded using uppercase characters instead of lowercase ones. SwitchParameter False Input Specifies the binary input in the form of an array of bytes. Byte[] Byte[] None UpperCase Indicates that the output should be encoded using uppercase characters instead of lowercase ones. SwitchParameter SwitchParameter False System.Byte[] System.String -------------------------- Example 1 -------------------------- PS C:\> ConvertTo-Hex -Input 0,255,32 00ff20 Converts the byte array to its hexadecimal representation, using lowercase characters. -------------------------- Example 2 -------------------------- PS C:\> ConvertTo-Hex -Input 0,255,32 -UpperCase 00FF20 Converts the byte array to its hexadecimal representation, using uppercase characters. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/ConvertTo-Hex.md ConvertTo-KerberosKey ConvertTo KerberosKey Computes Kerberos keys from a given password using Kerberos version 5 Key Derivation Functions. Supports the derivation of AES256, AES128, and DES encryption keys. ConvertTo-KerberosKey Password Specifies an input password from which kerberos keys will be derived. SecureString SecureString None Salt Specifies the salt parameter of the string-to-key functions. String String None Iterations Specifies the iteration count parameter of the string-to-key functions. Int32 Int32 4096 Iterations Specifies the iteration count parameter of the string-to-key functions. Int32 Int32 4096 Password Specifies an input password from which kerberos keys will be derived. SecureString SecureString None Salt Specifies the salt parameter of the string-to-key functions. String String None None DSInternals.Common.Data.KerberosKeyDataNew -------------------------- Example 1 -------------------------- PS C:\> $pwd = ConvertTo-SecureString -String 'Pa$$w0rd' -AsPlainText -Force PS C:\> ConvertTo-KerberosKey -Password $pwd -Salt 'CONTOSO.COMAdministrator' <# Sample Output: AES256_CTS_HMAC_SHA1_96 Key: 660e61042b190b5724c62bb473facca12058fb9ad3c03c0d2809f839c0352502 Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: bd75e98362b16649ffbaed630d5341d0 Iterations: 4096 DES_CBC_MD5 Key: aed02c52204ca2ce Iterations: 4096 #> Applies 3 different kerberos key derivation functions to the specified password and salt. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/ConvertTo-KerberosKey.md ConvertTo-NTHash ConvertTo-LMHash ConvertTo-LMHash ConvertTo LMHash Calculates LM hash of a given password. Applies the Lan Manager one-way function (LM OWF) to a given cleartext password and returns the resulting hash. ConvertTo-LMHash Password Specifies a password in the form of a SecureString. SecureString SecureString None Password Specifies a password in the form of a SecureString. SecureString SecureString None System.Security.SecureString System.String -------------------------- Example 1 -------------------------- PS C:\> ConvertTo-LMHash cmdlet ConvertTo-LMHash at command pipeline position 1 Supply values for the following parameters: (Type !? for Help.) Password: ******** 727e3576618fa1754a3b108f3fa6cb6d Reads a password from the command line and calculates its LM hash. -------------------------- Example 2 -------------------------- PS C:\> $pwd = ConvertTo-SecureString -String 'Pa$$w0rd' -AsPlainText -Force PS C:\> ConvertTo-LMHash -Password $pwd 727e3576618fa1754a3b108f3fa6cb6d Calculates the LM hash of password Pa$$w0rd . Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/ConvertTo-LMHash.md ConvertTo-NTHash ConvertTo-KerberosKey ConvertTo-NTHash ConvertTo NTHash Calculates NT hash of a given password. Applies the NT one-way function (NT OWF) to a given cleartext password and returns the resulting hash, which is just the MD4 hash function applied to the UTF-16 encoded input. This hash is sometimes called NTLM hash, because it is mainly used in the NTLM(v2) network authentication protocol. ConvertTo-NTHash Password Specifies a password in the form of a SecureString. SecureString SecureString None Password Specifies a password in the form of a SecureString. SecureString SecureString None System.Security.SecureString System.String -------------------------- Example 1 -------------------------- PS C:\> ConvertTo-NTHash cmdlet ConvertTo-NTHash at command pipeline position 1 Supply values for the following parameters: (Type !? for Help.) Password: ******** 92937945b518814341de3f726500d4ff Reads a password from the command line and calculates its NT hash. -------------------------- Example 2 -------------------------- PS C:\> $pwd = ConvertTo-SecureString -String 'Pa$$w0rd' -AsPlainText -Force PS C:\> ConvertTo-NTHash -Password $pwd 92937945b518814341de3f726500d4ff Calculates the NT hash of password Pa$$w0rd . Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/ConvertTo-NTHash.md ConvertTo-LMHash ConvertTo-KerberosKey ConvertTo-OrgIdHash ConvertTo OrgIdHash Calculates OrgId hash of a given password. Used by Azure Active Directory Connect. The OrgId hash is defined as PBKDF2( UTF-16( ToUpper( ToHex( MD4( UTF-16(plaintext))))), RND(10), 1000, HMAC-SHA256, 32). ConvertTo-OrgIdHash NTHash Provide a 16-byte NT Hash of user's password in hexadecimal format. Byte[] Byte[] None Salt Provide a 10-byte salt in hexadecimal format. Byte[] Byte[] None ConvertTo-OrgIdHash Password Provide a password in the form of a SecureString. SecureString SecureString None Salt Provide a 10-byte salt in hexadecimal format. Byte[] Byte[] None NTHash Provide a 16-byte NT Hash of user's password in hexadecimal format. Byte[] Byte[] None Password Provide a password in the form of a SecureString. SecureString SecureString None Salt Provide a 10-byte salt in hexadecimal format. Byte[] Byte[] None System.Security.SecureString System.Byte[] System.String -------------------------- Example 1 -------------------------- PS C:\> $pwd = ConvertTo-SecureString -String 'Pa$$w0rd' -AsPlainText -Force PS C:\> ConvertTo-OrgIdHash -Password $pwd <# Sample Output: v1;PPH1_MD4,60eaffd2c886b419df7a,1000,ab9c532104713157395a70da85cc8a1b418508753c6997f02341d541328ef16b; #> Calculates the OrgId hash from a cleartext password using a random salt. -------------------------- Example 2 -------------------------- PS C:\> ConvertTo-OrgIdHash -NTHash 92937945b518814341de3f726500d4ff <# Sample Output: v1;PPH1_MD4,46c0c5d9095185ce5cf8,1000,6bb7b360d9105ed5157460b343d5d143e465a59195bc9b568718268c334ea4a9; #> Calculates the OrgId hash from a NT hash while using a random salt. -------------------------- Example 3 -------------------------- PS C:\> ConvertTo-OrgIdHash -NTHash 92937945b518814341de3f726500d4ff -Salt a42b92067e4b8123101a <# Sample Output: v1;PPH1_MD4,a42b92067e4b8123101a,1000,f0fc762ea9051ef754652becd83ee5e54c1c857c1c0965abac5d85de9c143911; #> Calculates the OrgId hash from a NT hash while using the given salt. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/ConvertTo-OrgIdHash.md ConvertTo-NTHash ConvertTo-UnicodePassword ConvertTo UnicodePassword Converts a password to the format used in unattend.xml or *.ldif files. Converts a password to the Base64-encoded Unicode format that is used in Windows unattend.xml files or LDIF (LDAP Data Interchange Format) files. This format is required when specifying passwords in automated Windows deployment scenarios or when importing user accounts with passwords through LDIF. ConvertTo-UnicodePassword Password Specifies a password that will be converted to the specified format. SecureString SecureString None IsUnattendPassword Indicates that the result should be in the format for unattend.xml instead of *.ldif. SwitchParameter False IsUnattendPassword Indicates that the result should be in the format for unattend.xml instead of *.ldif. SwitchParameter SwitchParameter False Password Specifies a password that will be converted to the specified format. SecureString SecureString None None System.String -------------------------- Example 1 -------------------------- PS C:\> $password = Read-Host -AsSecureString -Prompt 'Enter password' PS C:\> ConvertTo-UnicodePassword -Password $password <# Sample Output: UABhAHMAcwB3ADAAcgBkAA== #> Converts a password to the Base64-encoded Unicode format suitable for use in LDIF files. -------------------------- Example 2 -------------------------- PS C:\> $password = Read-Host -AsSecureString -Prompt 'Enter password' PS C:\> ConvertTo-UnicodePassword -Password $password -IsUnattendPassword <# Sample Output: UABhAHMAcwB3ADAAcgBkAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAUABhAHMAcwB3AG8AcgBkAA== #> Converts a password to the format used in Windows unattend.xml files, which includes the "AdministratorPassword" suffix. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/ConvertTo-UnicodePassword.md Disable-ADDBAccount Disable ADDBAccount Disables an Active Directory account in an offline ntds.dit file. Finds an account in Active Directory database file and modifies the appropriate bit in its userAccountControl attribute. Disable-ADDBAccount DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Disable-ADDBAccount DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Disable-ADDBAccount DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Disable-ADDBAccount SamAccountName Specifies the identifier of an account on which to perform this operation. String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None SamAccountName Specifies the identifier of an account on which to perform this operation. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter SwitchParameter False System.String System.Security.Principal.SecurityIdentifier System.Guid None -------------------------- Example 1 -------------------------- PS C:\> Disable-ADDBAccount -SamAccountName john -DatabasePath .\ntds.dit Finds an account with name john and disables it. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Disable-ADDBAccount.md Enable-ADDBAccount Unlock-ADDBAccount Set-ADDBAccountControl Get-ADDBAccount Enable-ADDBAccount Enable ADDBAccount Enables an Active Directory account in an offline ntds.dit file. Finds an account in Active Directory database file and modifies the appropriate bit in its userAccountControl attribute. Enable-ADDBAccount DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Enable-ADDBAccount DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Enable-ADDBAccount DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Enable-ADDBAccount SamAccountName Specifies the identifier of an account on which to perform this operation. String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None SamAccountName Specifies the identifier of an account on which to perform this operation. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter SwitchParameter False System.String System.Security.Principal.SecurityIdentifier System.Guid None -------------------------- Example 1 -------------------------- PS C:\> Enable-ADDBAccount -SamAccountName john -DatabasePath .\ntds.dit Finds an account with name john and enables it. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Enable-ADDBAccount.md Disable-ADDBAccount Unlock-ADDBAccount Set-ADDBAccountControl Get-ADDBAccount Export-ADDBDnsServerSigningKey Export ADDBDnsServerSigningKey Exports DNSSEC signing key private keys from an Active Directory database to files. This cmdlet decrypts the DNSSEC signing key private keys that are stored in the specified Active Directory database file and writes each one to a file in the target directory. Each key is saved in the CNG private key blob format using the `{zone}_{guid}.pvk` naming convention. Export-ADDBDnsServerSigningKey DirectoryPath Specifies the path to the output directory where the exported signing key files are written. The directory must already exist. String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Indicates that existing signing key files in the output directory should be overwritten. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ZoneName Restricts the export to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DirectoryPath Specifies the path to the output directory where the exported signing key files are written. The directory must already exist. String String None Force Indicates that existing signing key files in the output directory should be overwritten. SwitchParameter SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ZoneName Restricts the export to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None System.String None -------------------------- Example 1 -------------------------- PS C:\> Export-ADDBDnsServerSigningKey -DatabasePath '.\ntds.dit' -DirectoryPath '.\Keys' -Verbose -Force <# Sample Output: VERBOSE: Wrote DNS signing key 0b2ec560-1db7-41aa-98c6-8bdacc8727e5 to 'C:\Keys\contoso.com_0b2ec560-1db7-41aa-98c6-8bdacc8727e5.pvk'. VERBOSE: Wrote DNS signing key 54462d7d-3b27-46b4-bc72-67eedd994003 to 'C:\Keys\contoso.com_54462d7d-3b27-46b4-bc72-67eedd994003.pvk'. VERBOSE: Wrote DNS signing key ddf94e7e-0ed8-4bbb-9447-03fe66202874 to 'C:\Keys\contoso.com_ddf94e7e-0ed8-4bbb-9447-03fe66202874.pvk'. VERBOSE: Wrote DNS signing key f91d2384-895d-45a2-adf9-f037624a107f to 'C:\Keys\contoso.com_f91d2384-895d-45a2-adf9-f037624a107f.pvk'. VERBOSE: Wrote DNS signing key 1c3737ea-f9a4-4902-b6a1-debc6227e627 to 'C:\Keys\contoso.com_1c3737ea-f9a4-4902-b6a1-debc6227e627.pvk'. VERBOSE: Wrote DNS signing key 8f35bfb0-2e9e-41e5-b165-feba44d1f206 to 'C:\Keys\contoso.com_8f35bfb0-2e9e-41e5-b165-feba44d1f206.pvk'. VERBOSE: Wrote DNS signing key becff19e-2a5d-409a-ad37-c6e730ec2620 to 'C:\Keys\contoso.com_becff19e-2a5d-409a-ad37-c6e730ec2620.pvk'. VERBOSE: Wrote DNS signing key f7953139-0209-487e-931e-fd217763b314 to 'C:\Keys\contoso.com_f7953139-0209-487e-931e-fd217763b314.pvk'. VERBOSE: Wrote DNS signing key 7488d063-5beb-4962-911b-baaccf1bb91d to 'C:\Keys\contoso.com_7488d063-5beb-4962-911b-baaccf1bb91d.pvk'. VERBOSE: Wrote DNS signing key 1a661c6a-b7e0-4efe-9fe2-98855f2a3a81 to 'C:\Keys\contoso.com_1a661c6a-b7e0-4efe-9fe2-98855f2a3a81.pvk'. VERBOSE: Wrote DNS signing key dc947fb5-42b9-4674-a3c6-1ab33ffdfa75 to 'C:\Keys\contoso.com_dc947fb5-42b9-4674-a3c6-1ab33ffdfa75.pvk'. VERBOSE: Wrote DNS signing key a49c47bb-ee02-4daa-a28c-18ae96626f2b to 'C:\Keys\contoso.com_a49c47bb-ee02-4daa-a28c-18ae96626f2b.pvk'. VERBOSE: Wrote DNS signing key 9e2e19e8-4515-414f-8f54-e59501bad001 to 'C:\Keys\contoso.com_9e2e19e8-4515-414f-8f54-e59501bad001.pvk'. #> Exports every DNSSEC signing key (including the rolled-over historical keys) from the offline database to the `.\Keys` directory, overwriting any existing files and reporting each written file path through the verbose stream. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Export-ADDBDnsServerSigningKey.md Get-ADDBDnsServerSigningKey Export-ADSIDnsServerSigningKey Get-ADDBDnsServerZone Export-ADSIDnsServerSigningKey Export ADSIDnsServerSigningKey Exports DNSSEC signing key private keys from Active Directory through LDAP to files. This cmdlet retrieves the DNSSEC signing keys from the target domain controller through LDAP, decrypts their private key material, and writes each one to a file in the target directory. Each key is saved in the CNG private key blob format using the `{zone}_{guid}.pvk` naming convention. Export-ADSIDnsServerSigningKey DirectoryPath Specifies the path to the output directory where the exported signing key files are written. The directory must already exist. String String None Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None Force Indicates that existing signing key files in the output directory should be overwritten. SwitchParameter False KdsRootKey Provides an explicit set of KDS root keys to use when decrypting the DPAPI-NG-protected signing key private keys. When this parameter is specified, the supplied keys override the default LDAP-based lookup against the configuration naming context. KdsRootKey[] KdsRootKey[] None Server Specifies the target domain controller. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None ZoneName Restricts the export to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None DirectoryPath Specifies the path to the output directory where the exported signing key files are written. The directory must already exist. String String None Force Indicates that existing signing key files in the output directory should be overwritten. SwitchParameter SwitchParameter False KdsRootKey Provides an explicit set of KDS root keys to use when decrypting the DPAPI-NG-protected signing key private keys. When this parameter is specified, the supplied keys override the default LDAP-based lookup against the configuration naming context. KdsRootKey[] KdsRootKey[] None Server Specifies the target domain controller. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None ZoneName Restricts the export to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None System.String None -------------------------- Example 1 -------------------------- PS C:\> Export-ADSIDnsServerSigningKey -DirectoryPath .\keys -Verbose -Force <# Sample Output: VERBOSE: Wrote DNS signing key 0b2ec560-1db7-41aa-98c6-8bdacc8727e5 to 'C:\keys\contoso.com_0b2ec560-1db7-41aa-98c6-8bdacc8727e5.pvk'. VERBOSE: Wrote DNS signing key 54462d7d-3b27-46b4-bc72-67eedd994003 to 'C:\keys\contoso.com_54462d7d-3b27-46b4-bc72-67eedd994003.pvk'. VERBOSE: Wrote DNS signing key ddf94e7e-0ed8-4bbb-9447-03fe66202874 to 'C:\keys\contoso.com_ddf94e7e-0ed8-4bbb-9447-03fe66202874.pvk'. VERBOSE: Wrote DNS signing key f91d2384-895d-45a2-adf9-f037624a107f to 'C:\keys\contoso.com_f91d2384-895d-45a2-adf9-f037624a107f.pvk'. VERBOSE: Wrote DNS signing key 1c3737ea-f9a4-4902-b6a1-debc6227e627 to 'C:\keys\contoso.com_1c3737ea-f9a4-4902-b6a1-debc6227e627.pvk'. VERBOSE: Wrote DNS signing key 8f35bfb0-2e9e-41e5-b165-feba44d1f206 to 'C:\keys\contoso.com_8f35bfb0-2e9e-41e5-b165-feba44d1f206.pvk'. VERBOSE: Wrote DNS signing key becff19e-2a5d-409a-ad37-c6e730ec2620 to 'C:\keys\contoso.com_becff19e-2a5d-409a-ad37-c6e730ec2620.pvk'. VERBOSE: Wrote DNS signing key f7953139-0209-487e-931e-fd217763b314 to 'C:\keys\contoso.com_f7953139-0209-487e-931e-fd217763b314.pvk'. VERBOSE: Wrote DNS signing key 7488d063-5beb-4962-911b-baaccf1bb91d to 'C:\keys\contoso.com_7488d063-5beb-4962-911b-baaccf1bb91d.pvk'. VERBOSE: Wrote DNS signing key 1a661c6a-b7e0-4efe-9fe2-98855f2a3a81 to 'C:\keys\contoso.com_1a661c6a-b7e0-4efe-9fe2-98855f2a3a81.pvk'. VERBOSE: Wrote DNS signing key dc947fb5-42b9-4674-a3c6-1ab33ffdfa75 to 'C:\keys\contoso.com_dc947fb5-42b9-4674-a3c6-1ab33ffdfa75.pvk'. VERBOSE: Wrote DNS signing key a49c47bb-ee02-4daa-a28c-18ae96626f2b to 'C:\keys\contoso.com_a49c47bb-ee02-4daa-a28c-18ae96626f2b.pvk'. VERBOSE: Wrote DNS signing key 9e2e19e8-4515-414f-8f54-e59501bad001 to 'C:\keys\contoso.com_9e2e19e8-4515-414f-8f54-e59501bad001.pvk'. #> Exports every DNSSEC signing key (including the rolled-over historical keys) to the current `.\keys` directory, overwriting any existing files and reporting each written file path through the verbose stream. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Export-ADSIDnsServerSigningKey.md Get-ADSIDnsServerSigningKey Export-ADDBDnsServerSigningKey Get-ADSIDnsServerZone Get-ADDBAccount Get ADDBAccount Reads one or more accounts from a ntds.dit file, including secret attributes. Reads one or more accounts from an Active Directory database file. When provided with a boot key (AKA SysKey or system key), it also decrypts secret attributes. Get-ADDBAccount All Indicates that all accounts will be read from the selected database. SwitchParameter False BootKey Specifies the boot key (AKA system key) that will be used to decrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None ExportFormat Specifies the format in which the account information will be displayed. JohnNT JohnNTHistory JohnLM JohnLMHistory HashcatNT HashcatNTHistory HashcatLM HashcatLMHistory NTHash NTHashHistory LMHash LMHashHistory Ophcrack PWDump PWDumpHistory AccountExportFormat AccountExportFormat None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Get-ADDBAccount BootKey Specifies the boot key (AKA system key) that will be used to decrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account that will be retrieved from the database. String String None ExportFormat Specifies the format in which the account information will be displayed. JohnNT JohnNTHistory JohnLM JohnLMHistory HashcatNT HashcatNTHistory HashcatLM HashcatLMHistory NTHash NTHashHistory LMHash LMHashHistory Ophcrack PWDump PWDumpHistory AccountExportFormat AccountExportFormat None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Get-ADDBAccount BootKey Specifies the boot key (AKA system key) that will be used to decrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None ExportFormat Specifies the format in which the account information will be displayed. JohnNT JohnNTHistory JohnLM JohnLMHistory HashcatNT HashcatNTHistory HashcatLM HashcatLMHistory NTHash NTHashHistory LMHash LMHashHistory Ophcrack PWDump PWDumpHistory AccountExportFormat AccountExportFormat None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an account that will be retrieved from the database. Guid Guid None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Get-ADDBAccount BootKey Specifies the boot key (AKA system key) that will be used to decrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None ExportFormat Specifies the format in which the account information will be displayed. JohnNT JohnNTHistory JohnLM JohnLMHistory HashcatNT HashcatNTHistory HashcatLM HashcatLMHistory NTHash NTHashHistory LMHash LMHashHistory Ophcrack PWDump PWDumpHistory AccountExportFormat AccountExportFormat None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectSid Specifies the identifier of an account that will be retrieved from the database. SecurityIdentifier SecurityIdentifier None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Get-ADDBAccount SamAccountName Specifies the identifier of an account that will be retrieved from the database. String String None BootKey Specifies the boot key (AKA system key) that will be used to decrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None ExportFormat Specifies the format in which the account information will be displayed. JohnNT JohnNTHistory JohnLM JohnLMHistory HashcatNT HashcatNTHistory HashcatLM HashcatLMHistory NTHash NTHashHistory LMHash LMHashHistory Ophcrack PWDump PWDumpHistory AccountExportFormat AccountExportFormat None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All All Indicates that all accounts will be read from the selected database. SwitchParameter SwitchParameter False BootKey Specifies the boot key (AKA system key) that will be used to decrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account that will be retrieved from the database. String String None ExportFormat Specifies the format in which the account information will be displayed. AccountExportFormat AccountExportFormat None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an account that will be retrieved from the database. Guid Guid None ObjectSid Specifies the identifier of an account that will be retrieved from the database. SecurityIdentifier SecurityIdentifier None Properties Specifies the set of properties that will be retrieved for each account. AccountPropertySets AccountPropertySets All SamAccountName Specifies the identifier of an account that will be retrieved from the database. String String None System.String System.Security.Principal.SecurityIdentifier System.Guid DSInternals.Common.Data.DSAccount DSInternals.Common.Data.DSUser DSInternals.Common.Data.DSComputer -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBAccount -SamAccountName Administrator ` -DatabasePath 'C:\IFM Backup\Active Directory\ntds.dit' <# Sample Output: DistinguishedName: CN=Administrator,CN=Users,DC=contoso,DC=com SamAccountName: Administrator UserPrincipalName: Enabled: True Deleted: False Sid: S-1-5-21-1236425271-2880748467-2592687428-500 Guid: b3d02974-6b1c-484c-9103-fd2f60d592c4 SamAccountType: User UserAccountControl: NormalAccount, PasswordNeverExpires Description: Built-in account for administering the computer/domain Notes: PrimaryGroupId: 513 AdminCount: True SidHistory: SupportedEncryptionTypes: Default ServicePrincipalName: LastLogonDate: 2/6/2025 12:26:33 PM PasswordLastSet: 1/31/2025 10:24:08 AM SecurityDescriptor: DiscretionaryAclPresent, SystemAclPresent, DiscretionaryAclAutoInherited, SystemAclAutoInherited, DiscretionaryAclProtected, SelfRelative GivenName: Surname: Initials: DisplayName: Email: StreetAddress: City: PostalCode: State: Country: Office: TelephoneNumber: Mobile: HomePhone: Company: Department: JobTitle: EmployeeID: EmployeeNumber: ProfilePath: ScriptPath: Key Credentials Credential Roaming Created: Modified: Credentials: Secrets NTHash: LMHash: NTHashHistory: LMHashHistory: SupplementalCredentials: #> Retrieves information about a single user account from an Active Directory database. Secret attributes are not decrypted as no boot key is provided. -------------------------- Example 2 -------------------------- PS C:\> $key = Get-BootKey -SystemHiveFilePath 'C:\IFM Backup\registry\SYSTEM' PS C:\> Get-ADDBAccount -DistinguishedName 'CN=Joe Smith,OU=Employees,DC=contoso,DC=com' ` -BootKey $key ` -DatabasePath 'C:\IFM Backup\Active Directory\ntds.dit' <# Sample Output: DistinguishedName: CN=Joe Smith,OU=Employees,DC=contoso,DC=com SamAccountName: joe UserPrincipalName: joe@contoso.com Enabled: True Deleted: False Sid: S-1-5-21-1236425271-2880748467-2592687428-1110 Guid: 6fb7aca4-fe85-4dc5-9acd-b5b2529fe2bc SamAccountType: User UserAccountControl: NormalAccount, PasswordNeverExpires Description: Joe's standard account Notes: Lorem Ipsum AdminCount: False PrimaryGroupId: 513 SidHistory: SupportedEncryptionTypes: Default ServicePrincipalName: LastLogonDate: 2/23/2015 10:27:18 AM PasswordLastSet: 7/11/2014 11:35:47 AM SecurityDescriptor: DiscretionaryAclPresent, SystemAclPresent, DiscretionaryAclAutoInherited, SystemAclAutoInherited, SelfRelative GivenName: Joe Surname: Smith Initials: RR DisplayName: Joe Smith Email: joe@contoso.com StreetAddress: 1 Microsoft Way City: Redmond PostalCode: 98052 State: Washington Country: US Office: A309 TelephoneNumber: 0118 999 881 999 119 7253 Mobile: (312) 555-0690 HomePhone: (408) 555-1439 Company: Contoso Department: IT JobTitle: Admin EmployeeID: EmployeeNumber: Manager: CN=rodriquez,OU=Employees,DC=contoso,DC=com ProfilePath: ScriptPath: Key Credentials Usage=NGC, Source=ActiveDirectory, Device=1966d4da-14da-4581-a7a7-5e8e07e93ad9, Created=8/1/2019 10:53:12 PM, LastLogon=8/1/2019 10:53:12 PM Usage=NGC, Source=ActiveDirectory, Device=cfe9a872-13ff-4751-a777-aec88c30a762, Created=8/1/2019 11:09:15 PM, LastLogon=8/1/2019 11:09:15 PM Credential Roaming Created: 3/12/2017 9:15:56 AM Modified: 3/13/2017 10:01:18 AM Credentials: DPAPIMasterKey: joe\Protect\S-1-5-21-1236425271-2880748467-2592687428-1110\47070660-c259-4d90-8bc9-187605323450 DPAPIMasterKey: joe\Protect\S-1-5-21-1236425271-2880748467-2592687428-1110\7fc19508-7b85-4a7c-9e5d-15f9e00e7ce5 CryptoApiCertificate: joe\SystemCertificates\My\Certificates\574E4687133998544C0095C7B348C52CD398182E CNGCertificate: joe\SystemCertificates\My\Certificates\3B83BFA7037F6A79B3F3D17D229E1BC097F35B51 RSAPrivateKey: joe\Crypto\RSA\S-1-5-21-1236425271-2880748467-2592687428-1110\701577141985b6923998dcca035c007a_f8b7bbef-d227-4ac7-badd-3a238a7f741e CNGPrivateKey: joe\Crypto\Keys\E8F13C2BA0209401C4DFE839CD57375E26BBE38F Secrets NTHash: 92937945b518814341de3f726500d4ff LMHash: NTHashHistory: Hash 01: 92937945b518814341de3f726500d4ff LMHashHistory: Hash 01: 30ce97eef1084cf1656cc4be70d68600 SupplementalCredentials: ClearText: NTLMStrongHash: 2c6d57beebeafdae65b3f40f2a0d5430 Kerberos: Credentials: DES_CBC_MD5 Key: 7f16bc4ada0b8a52 OldCredentials: Salt: CONTOSO.COMjoe Flags: 0 KerberosNew: Credentials: AES256_CTS_HMAC_SHA1_96 Key: cd541be0838c787b5c6a34d7b19274aee613545a0e6cc6f5ac5918d8a464d24f Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 5c88972747bd454704c117ae52c474e4 Iterations: 4096 DES_CBC_MD5 Key: 7f16bc4ada0b8a52 Iterations: 4096 OldCredentials: OlderCredentials: ServiceCredentials: Salt: CONTOSO.COMjoe DefaultIterationCount: 4096 Flags: 0 WDigest: Hash 01: 61fed940f0e8d03a49d3727f55800497 Hash 02: a1d54499dda6a6b5431f29a8d741a640 Hash 03: b6cdf00bc0c4578992f718de81251721 Hash 04: 61fed940f0e8d03a49d3727f55800497 Hash 05: a1d54499dda6a6b5431f29a8d741a640 Hash 06: 9a8991bd99763df2e37f1e1e67d71cc8 Hash 07: 61fed940f0e8d03a49d3727f55800497 Hash 08: 8a9fe94883c8ccf3bcfc6591ddd2288f Hash 09: 8a9fe94883c8ccf3bcfc6591ddd2288f Hash 10: 1b7b16b49ecd8d9d59c1d0db6fa2cc36 Hash 11: d4c24695cfa4dc3810a469d5efb8ecaf Hash 12: 8a9fe94883c8ccf3bcfc6591ddd2288f Hash 13: a5b8aa5088280298c8c27fa99dcaa1e3 Hash 14: d4c24695cfa4dc3810a469d5efb8ecaf Hash 15: 1aa8e567622fe53d6fb36f1f34f12aaa Hash 16: 1aa8e567622fe53d6fb36f1f34f12aaa Hash 17: 2af425244079f8f45927c34fa115e45b Hash 18: cf283a35102b820e25003b1ddf270221 Hash 19: b98c902c57449253e6f06b5d585866bd Hash 20: 2a690b1eeda9cb8f3157a4a3ba0be9c3 Hash 21: af2654776d5f9f27f3283ecb0aa25011 Hash 22: af2654776d5f9f27f3283ecb0aa25011 Hash 23: ba6fe0513ed2a60ec253a41bbde6a837 Hash 24: 8bf5a67b598087be948e040f85c72b4d Hash 25: 8bf5a67b598087be948e040f85c72b4d Hash 26: aa5ff46d23a5c7ebd603e1793225350d Hash 27: 656b6a7f5b52d05b3ce9168a2b7ac8ac Hash 28: ae884c92ecd87e8d54f1844f09c5a519 Hash 29: a500a9e26afc9f817df8a07e15771577 #> Retrieves information about a single user account from an Active Directory database. Secret attributes are decrypted using the provided boot key. -------------------------- Example 3 -------------------------- PS C:\> $key = Get-BootKey -SystemHiveFilePath 'C:\IFM Backup\registry\SYSTEM' PS C:\> Get-ADDBAccount -SamAccountName 'PC01$' ` -BootKey $key ` -DatabasePath 'C:\IFM Backup\Active Directory\ntds.dit' <# Sample Output: DistinguishedName: CN=PC01,CN=Computers,DC=contoso,DC=com SamAccountName: PC01$ Enabled: True Deleted: False Sid: S-1-5-21-2072841070-1873892158-2095746001-1104 Guid: 34017f6d-a264-4681-8738-09780122884f SamAccountType: Computer UserAccountControl: WorkstationAccount DNSHostName: PC01.contoso.com OperatingSystem: Windows 11 Enterprise OperatingSystemVersion: 10.0 (26100) Description: John's computer ManagedBy: CN=John Doe,OU=Employees,DC=contoso,DC=com PrimaryGroupId: 515 Location: USA/WA/Seattle SidHistory: SupportedEncryptionTypes: RC4_HMAC, AES128_CTS_HMAC_SHA1_96, AES256_CTS_HMAC_SHA1_96 ServicePrincipalName: {HOST/PC01.contoso.com, RestrictedKrbHost/PC01.contoso.com, HOST/PC01, RestrictedKrbHost/PC01...} LastLogonDate: 1/27/2025 9:22:36 AM PasswordLastSet: 1/22/2025 9:23:45 PM SecurityDescriptor: DiscretionaryAclPresent, SystemAclPresent, DiscretionaryAclAutoInherited, SystemAclAutoInherited, SelfRelative LAPS Password: A6a3#7%eb!57be, Expires: 1/24/2025 9:12:27 PM Key Credentials Usage: NGC, Source: AD, Device: , Created: 11/23/2024 10:58:30 PM Secrets NTHash: 0ec8485560274b5352fab8085f83f5cf LMHash: NTHashHistory: Hash 01: 0ec8485560274b5352fab8085f83f5cf Hash 02: d3981b0fa179f60b3eac48ea0aa06b62 Hash 03: f6ab2345d24e09993c972087d189a365 LMHashHistory: Hash 01: ecb0097500ffd72b005071e31a237ed5 Hash 02: 1d16a311401fba1f5d95090cb4fcacdb Hash 03: 1224652b76e22751d79a06a7ce796e56 SupplementalCredentials: ClearText: NTLMStrongHash: Kerberos: KerberosNew: Credentials: AES256_CTS_HMAC_SHA384_192 Key: f97e0809c70a0c88aa5e6bc2d891f44e56ded641425a9bb0e9468f83a89b23d1 Iterations: 4096 AES128_CTS_HMAC_SHA256_128 Key: b5bf869da88f6d23c7a7e0585fc4d385 Iterations: 4096 AES256_CTS_HMAC_SHA1_96 Key: 099378565ec8edb5be48624bf1af8569c63963a28cb5a2e165668b618bb39d0c Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 483599c78841e3d14c91283a33ceaa38 Iterations: 4096 RC4_HMAC_NT Key: 0ec8485560274b5352fab8085f83f5cf Iterations: 4096 OldCredentials: AES256_CTS_HMAC_SHA384_192 Key: ab6e6e6c22a3689cccfaee4a46744cd5fa25b466992246b9d5474090dc6a6d32 Iterations: 4096 AES128_CTS_HMAC_SHA256_128 Key: cca81c6d197a8619f81d67db8b2f510f Iterations: 4096 AES256_CTS_HMAC_SHA1_96 Key: 7a59559a82e25d7c3b11ba9746a0af776905d404e17c07be9dc7f45689600017 Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 6203b2af5353b22f7948f4dc393fc2e3 Iterations: 4096 RC4_HMAC_NT Key: d3981b0fa179f60b3eac48ea0aa06b62 Iterations: 4096 OlderCredentials: AES256_CTS_HMAC_SHA384_192 Key: 662eb233817c7f92fe89d956b66522193848c94851176a962c76092932e195bd Iterations: 4096 AES128_CTS_HMAC_SHA256_128 Key: 36b9535feaf1127aa3f7b4940345b6b9 Iterations: 4096 AES256_CTS_HMAC_SHA1_96 Key: 3bed800004f155ad9d7b7492ca1b4902b3dca64dbca503b94d8cdc622b3a69aa Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 29f2bbec3fb8a177c788afc4c24d368a Iterations: 4096 RC4_HMAC_NT Key: f6ab2345d24e09993c972087d189a365 Iterations: 4096 ServiceCredentials: AES256_CTS_HMAC_SHA384_192 Key: f97e0809c70a0c88aa5e6bc2d891f44e56ded641425a9bb0e9468f83a89b23d1 Iterations: 4096 AES128_CTS_HMAC_SHA256_128 Key: b5bf869da88f6d23c7a7e0585fc4d385 Iterations: 4096 AES256_CTS_HMAC_SHA1_96 Key: 099378565ec8edb5be48624bf1af8569c63963a28cb5a2e165668b618bb39d0c Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 483599c78841e3d14c91283a33ceaa38 Iterations: 4096 Salt: CONTOSO.COMhostpc01.contoso.com DefaultIterationCount: 4096 Flags: 0 WDigest: Hash 01: 51ec1c08dc1515d691f86c35efd6951a Hash 02: 0804fe417162838cee1b585e05403c7e Hash 03: 51ec1c08dc1515d691f86c35efd6951a Hash 04: 51ec1c08dc1515d691f86c35efd6951a Hash 05: f7dfe69378cd20462567a3f12d306d9c Hash 06: f7dfe69378cd20462567a3f12d306d9c Hash 07: 84d3754825bb778f150e2e0f9e0ad791 Hash 08: c3f6531e37407660f4eaab3685b10c77 Hash 09: 7c9c69f0f4af01f24d00cd7fd40f0ad8 Hash 10: abbb73611689c4726a81d89adbb58a76 Hash 11: abbb73611689c4726a81d89adbb58a76 Hash 12: c3f6531e37407660f4eaab3685b10c77 Hash 13: c3f6531e37407660f4eaab3685b10c77 Hash 14: 2597e2d6baeb6a27746efa36afb108ce Hash 15: b7e76a5d9451f3e9dbfcbab122dde4a7 Hash 16: 299ed0932d98d3c08f0037402cc4b025 Hash 17: 13188b1800edb36ce4a5ebae8bdc163d Hash 18: cd9d520759c3919e442437eb84d3fecf Hash 19: 7eb065737a969f09daf7650ca1aa9441 Hash 20: cd9d520759c3919e442437eb84d3fecf Hash 21: b491f3531400f2a25ac123c74f698109 Hash 22: 55ab8a2e40e730d1d7426d5b71842021 Hash 23: b491f3531400f2a25ac123c74f698109 Hash 24: eec9350591609e3caef02e6ebc5b5da5 Hash 25: 9046b70b3f463105ac60d72d14d083ee Hash 26: 45a252b159aec8f9e6a6c18dac468b47 Hash 27: a5e2fb397f93c24f53c055bb8e38975a Hash 28: db978e9c18bca0774a2b53ddf9c20d45 Hash 29: a5e2fb397f93c24f53c055bb8e38975a #> Retrieves information about a single computer account from an Active Directory database. Secret attributes are decrypted using the provided boot key. -------------------------- Example 4 -------------------------- PS C:\> $results = Get-ADDBAccount -DatabasePath '.\Active Directory\ntds.dit' ` -BootKey acdba64a3929261b04e5270c3ef973cf ` -All ` -Properties Secrets | Test-PasswordQuality -WeakPasswordHashesSortedFile pwned-passwords-ntlm-ordered-by-hash-v5.txt Performs an offline credential hygiene audit of AD database against HIBP. -------------------------- Example 5 -------------------------- PS C:\> Get-ADDBAccount -All -DatabasePath ntds.dit -BootKey $key -ExportFormat PwDump | Where-Object SamAccountType -eq User | Where-Object Enabled -eq $true | Where-Object NTHash -ne $null | Out-File -FilePath users.pwdump -Encoding ascii Exports NT and LM password hashes from an Active Directory database to a pwdump file. -------------------------- Example 6 -------------------------- PS C:\> Get-ADDBBackupKey -DatabasePath '.\ADBackup\Active Directory\ntds.dit' ` -BootKey 0be7a2afe1713642182e9b96f73a75da | Save-DpapiBlob -DirectoryPath '.\Output' PS C:\> Get-ADDBAccount -All -DatabasePath '.\ADBackup\Active Directory\ntds.dit' -Properties RoamedCredentials | Save-DpapiBlob -DirectoryPath '.\Output' Extracts DPAPI backup keys and roamed credentials (certificates, private keys, and DPAPI master keys) from an Active Directory database file and saves them to the Output directory. Also creates a file called kiwiscript.txt that contains mimikatz commands needed to decrypt the private keys. -------------------------- Example 7 -------------------------- PS C:\> Get-ADDBAccount -All -DatabasePath '.\ADBackup\Active Directory\ntds.dit' -Properties KeyCredentials | Select-Object -ExpandProperty KeyCredentials | Where-Object Usage -eq NGC | Format-Table -View ROCA <# Sample Output: Usage IsWeak Source DeviceId Created Owner ----- ------ ------ -------- ------- ----- NGC True AzureAD fd591087-245c-4ff5-a5ea-c14de5e2b32d 2017-07-19 CN=John Doe,CN=Users,DC=contoso,DC=com NGC False AD 1966d4da-14da-4581-a7a7-5e8e07e93ad9 2019-08-01 CN=Jane Doe,CN=Users,DC=contoso,DC=com #> Lists weak public keys registered in Active Directory that were generated on ROCA-vulnerable TPMs. -------------------------- Example 8 -------------------------- PS C:\> $dc = Get-ADDBDomainController -DatabasePath '.\ADBackup\Active Directory\ntds.dit' PS C:\> $adminSid = '{0}-500' -f $dc.DomainSid PS C:\> $account = Get-ADDBAccount -Sid $adminSid ` -DatabasePath '.\ADBackup\Active Directory\ntds.dit' ` -BootKey 0be7a2afe1713642182e9b96f73a75da Retrieves information about a the the built-in Administrator account, even if it was renamed. -------------------------- Example 9 -------------------------- PS C:\> Get-ADDBAccount -DatabasePath '.\ADBackup\Active Directory\ntds.dit' -All -Properties LAPS | Select-Object -ExpandProperty LapsPasswords <# Sample Output: ComputerName Account Password Expires Source ------------ ------- -------- ------- ----- DC01 Administrator PluralTrimmingSuggest 2/3/2025 EncryptedDSRMPassword DC02 Administrator RoundupFructoseRoundworm 2/3/2025 EncryptedDSRMPassword ADFS01 WLapsAdmin HerbsSkidUnproven 2/3/2025 EncryptedPassword PC01 Administrator A6a3#7%eb!57be4a4B95Z433 1/24/2025 CleartextPassword #> Retrieves and decrypts all Windows+Legacy LAPS passwords from a ntds.dit file. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADDBAccount.md Get-BootKey Get-ADDBServiceAccount Get-ADDBTrust Get-ADDBBitLockerRecoveryInformation Get-ADDBBackupKey Get-ADReplAccount Get-ADSIAccount Test-PasswordQuality Save-DpapiBlob Get-ADKeyCredential Set-ADDBPrimaryGroup Add-ADDBSidHistory Set-ADDBAccountControl Get-ADDBBackupKey Get ADDBBackupKey Reads the DPAPI backup keys from a ntds.dit file. Reads and decrypts Data Protection API (DPAPI) backup keys from an Active Directory database file. The output can be saved to the file system using the Save-DpapiBlob cmdlet. DPAPI is used by several components of Windows to securely store passwords, encryption keys and other sensitive data. When DPAPI is used in an Active Directory domain environment, a copy of the user's master key is encrypted with a so-called DPAPI Domain Backup Key that is known to all domain controllers. Windows Server 2000 DCs use a symmetric key and newer systems use a public/private key pair. If the user password is reset and the original master key is rendered inaccessible to the user, the user's access to the master key is automatically restored using the backup key. Get-ADDBBackupKey BootKey Specifies the boot key (AKA system key) that will be used to decrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None BootKey Specifies the boot key (AKA system key) that will be used to decrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None None DSInternals.Common.Data.DPAPIBackupKey -------------------------- Example 1 -------------------------- PS C:\> $key = Get-BootKey -SystemHiveFilePath '.\ADBackup\registry\SYSTEM' PS C:\> Get-ADDBBackupKey -DatabasePath '.\ADBackup\Active Directory\ntds.dit' ` -BootKey $key | Format-List <# Sample Output: FilePath : ntds_legacy_b116cbfa-b881-43e6-ba85-ef3efa64ba22.key KiwiCommand : Type : LegacyKey DistinguishedName : CN=BCKUPKEY_b116cbfa-b881-43e6-ba85-ef3efa64ba22 Secret,CN=System,DC=contoso,DC=com KeyId : b116cbfa-b881-43e6-ba85-ef3efa64ba22 Data : {1, 0, 0, 0...} FilePath : KiwiCommand : Type : PreferredLegacyKeyPointer DistinguishedName : CN=BCKUPKEY_P Secret,CN=System,DC=contoso,DC=com KeyId : b116cbfa-b881-43e6-ba85-ef3efa64ba22 Data : {250, 203, 22, 177...} FilePath : ntds_capi_290914ed-b1a8-482e-a89f-7caa217bf3c3.pvk KiwiCommand : REM Add this parameter to at least the first dpapi::masterkey command: /pvk:"ntds_capi_290914ed-b1a8-482e-a89f-7caa217bf3c3.pvk" Type : RSAKey DistinguishedName : CN=BCKUPKEY_290914ed-b1a8-482e-a89f-7caa217bf3c3 Secret,CN=System,DC=contoso,DC=com KeyId : 290914ed-b1a8-482e-a89f-7caa217bf3c3 Data : {2, 0, 0, 0...} FilePath : KiwiCommand : Type : PreferredRSAKeyPointer DistinguishedName : CN=BCKUPKEY_PREFERRED Secret,CN=System,DC=contoso,DC=com KeyId : 290914ed-b1a8-482e-a89f-7caa217bf3c3 Data : {237, 20, 9, 41...} #> Extracts the boot key (AKA SysKey or system key) from a backup of the SYSTEM registry hive and decrypts all DPAPI backup keys stored in an Active Directory database file. -------------------------- Example 2 -------------------------- PS C:\> Get-ADDBBackupKey -DatabasePath '.\ADBackup\Active Directory\ntds.dit' ` -BootKey 0be7a2afe1713642182e9b96f73a75da | Save-DpapiBlob -DirectoryPath '.\Output' PS C:\> Get-ChildItem -Path '.\Output' | Select-Object -ExpandProperty Name <# Sample Output: kiwiscript.txt ntds_legacy_b116cbfa-b881-43e6-ba85-ef3efa64ba22.key ntds_capi_4cee80c0-b6c6-406c-a68b-c0e5818bc436.cer ntds_capi_290914ed-b1a8-482e-a89f-7caa217bf3c3.pfx ntds_capi_290914ed-b1a8-482e-a89f-7caa217bf3c3.pvk #> Exports DPAPI backup keys to the Output directory. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADDBBackupKey.md Save-DpapiBlob Get-ADReplBackupKey Get-LsaBackupKey Get-ADDBBitLockerRecoveryInformation Get ADDBBitLockerRecoveryInformation Reads BitLocker recovery passwords from a ntds.dit file. BitLocker recovery information (msFVE-RecoveryInformation objects) can be used to unlock volumes encrypted using BitLocker Drive Encryption. Get-ADDBBitLockerRecoveryInformation All Indicates that all BitLocker recovery keys should be read from the selected database. SwitchParameter False DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None Get-ADDBBitLockerRecoveryInformation ComputerName Specifies the name of the computer whose BitLocker recovery keys should be fetched from the database. String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None Get-ADDBBitLockerRecoveryInformation DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the distinguished name of the recovery key to fetch from the database. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None Get-ADDBBitLockerRecoveryInformation DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the recovery key object identifier to search for, for instance, 9a36024b-3e97-4305-8315-5ed0ff646367. Guid Guid None Get-ADDBBitLockerRecoveryInformation DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None RecoveryGuid Specifies the recovery key identifier to search for, for instance, 11c43ee8-b9d3-4e51-b73f-bd9dda66e29c. Guid Guid None All Indicates that all BitLocker recovery keys should be read from the selected database. SwitchParameter SwitchParameter False ComputerName Specifies the name of the computer whose BitLocker recovery keys should be fetched from the database. String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the distinguished name of the recovery key to fetch from the database. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the recovery key object identifier to search for, for instance, 9a36024b-3e97-4305-8315-5ed0ff646367. Guid Guid None RecoveryGuid Specifies the recovery key identifier to search for, for instance, 11c43ee8-b9d3-4e51-b73f-bd9dda66e29c. Guid Guid None System.Guid System.String DSInternals.Common.Data.BitLockerRecoveryInformation -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBBitLockerRecoveryInformation -All -DatabasePath '.\ADBackup\Active Directory\ntds.dit' <# Sample Output: ComputerName RecoveryGuid RecoveryPassword ------------ ------------ ---------------- PC01 704b1998-54ea-4899-8f46-81628b6a0731 366561-423260-035024-137224-631070-580492-357566-596908 PC02 caeaa622-6c6a-4d2b-8e33-29e46df659af 782066-216356-283624-291397-405614-078166-321530-943804 #> Retrieves all BitLocker recovery keys from an AD database. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADDBBitLockerRecoveryInformation.md Get-ADDBDomainController Get-ADDBDnsServerResourceRecord Get ADDBDnsServerResourceRecord Retrieves DNS resource records from an Active Directory database. Retrieves DNS resource records from an offline Active Directory database. The output can include tombstoned records and root hints if specified. Get-ADDBDnsServerResourceRecord DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None IncludeRootHints Indicates that root hints should be included in the output. SwitchParameter False IncludeTombstones Indicates that tombstoned DNS records should be included in the output. SwitchParameter False IncludeTrustAnchors Indicates that DNSSEC trust anchor records should be included in the output. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ZoneName Restricts the output to records belonging to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None IncludeRootHints Indicates that root hints should be included in the output. SwitchParameter SwitchParameter False IncludeTombstones Indicates that tombstoned DNS records should be included in the output. SwitchParameter SwitchParameter False IncludeTrustAnchors Indicates that DNSSEC trust anchor records should be included in the output. SwitchParameter SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ZoneName Restricts the output to records belonging to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None System.String DSInternals.Common.DNS.DnsResourceRecord -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBDnsServerResourceRecord -DatabasePath 'C:\IFM Backup\Active Directory\ntds.dit' | Where-Object Zone -eq 'contoso.com' | Where-Object Type -in SOA,NS,A,CNAME,MX,CNAME | Sort-Object -Property Name <# Sample Output: @ IN SOA dc01.contoso.com. hostmaster.contoso.com. ( 186 ; serial number 900 ; refresh 600 ; retry 86400 ; expire 3600 ) ; default TTL @ NS dc01.contoso.com. @ NS dc02.contoso.com. @ 600 A 10.213.0.3 @ 600 A 10.213.0.9 _msdcs NS dc01.contoso.com. certauth.login A 10.213.0.4 dc01 A 10.213.0.3 dc02 A 10.213.0.9 DomainDnsZones 600 A 10.213.0.9 DomainDnsZones 600 A 10.213.0.3 ForestDnsZones 600 A 10.213.0.9 ForestDnsZones 600 A 10.213.0.3 ftp CNAME www login A 10.213.0.4 #> Extracts all DNS resource records from the offline Active Directory database file and displays the SOA, NS, A, CNAME, MX, and CNAME records from the contoso.com zone in a text format compatible with Windows Server and BIND zone files. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADDBDnsServerResourceRecord.md Get-ADDBDnsServerZone Save-DnsServerResourceRecord Get-ADDBDomainController Get-ADDBDnsServerSigningKey Get ADDBDnsServerSigningKey Retrieves DNSSEC signing key descriptors from an Active Directory database. This cmdlet retrieves the DNSSEC zone signing key (ZSK) and key signing key (KSK) descriptors that are stored in the specified Active Directory database file. Only the key metadata is returned; use the Export-ADDBDnsServerSigningKey cmdlet to export the private key material. Get-ADDBDnsServerSigningKey DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ZoneName Restricts the output to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ZoneName Restricts the output to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None System.String DSInternals.Common.DNS.DnsSigningKeyDescriptor -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBDnsServerSigningKey -DatabasePath '.\ntds.dit' -ZoneName 'contoso.com' <# Sample Output: ZoneName : contoso.com KeyId : e6eb8329-330c-4dd3-9989-2827434cb3d5 KeyType : KeySigningKey CryptoAlgorithm : EcDsaP256Sha256 KeyLength : 256 CurrentState : Active ZoneSignatureValidityPeriod : 10.00:00:00 DnsKeySignatureValidityPeriod : 7.00:00:00 DSSignatureValidityPeriod : 7.00:00:00 IsRolloverEnabled : True RolloverType : DoubleSignature RolloverPeriod : 755.00:00:00 InitialRolloverOffset : 00:00:00 CurrentRolloverStatus : NotRolling NextRolloverAction : Normal LastRolloverTime : NextRolloverTime : 6/10/2028 9:21:46 AM NextKeyGenerationTime : KeyStorageProvider : Microsoft Software Key Storage Provider StoreKeysInAD : True ActiveKey : f91d2384-895d-45a2-adf9-f037624a107f ActiveKeyScope : Default NextKey : NextKeyScope : Default StandbyKey : ddf94e7e-0ed8-4bbb-9447-03fe66202874 StandbyKeyScope : AddOnly ZoneName : contoso.com KeyId : 2e8c3148-04b3-462d-ae45-d87fe631fcee KeyType : ZoneSigningKey CryptoAlgorithm : RsaSha256 KeyLength : 1024 CurrentState : Active ZoneSignatureValidityPeriod : 10.00:00:00 DnsKeySignatureValidityPeriod : 7.00:00:00 DSSignatureValidityPeriod : 7.00:00:00 IsRolloverEnabled : True RolloverType : PrePublish RolloverPeriod : 90.00:00:00 InitialRolloverOffset : 00:00:00 CurrentRolloverStatus : NotRolling NextRolloverAction : Normal LastRolloverTime : 3/28/2026 12:35:27 AM NextRolloverTime : 8/15/2026 9:21:46 AM NextKeyGenerationTime : 5/17/2026 9:21:46 AM KeyStorageProvider : Microsoft Software Key Storage Provider StoreKeysInAD : True ActiveKey : 1c3737ea-f9a4-4902-b6a1-debc6227e627 ActiveKeyScope : Default NextKey : 0b2ec560-1db7-41aa-98c6-8bdacc8727e5 NextKeyScope : AddOnly StandbyKey : StandbyKeyScope : Default #> Retrieves the DNSSEC signing key descriptors for the contoso.com zone from the specified Active Directory database file. The zone is protected by a key signing key (KSK) and a zone signing key (ZSK). -------------------------- Example 2 -------------------------- PS C:\> Get-ADDBDnsServerSigningKey -DatabasePath '.\ntds.dit' | Format-Table <# Sample Output: ZoneName KeyType Algorithm KeyLength State RolloverType -------- ------- --------- --------- ----- ------------ contoso.com KeySigningKey EcDsaP256Sha256 256 Active DoubleSignature contoso.com ZoneSigningKey RsaSha256 1024 Active PrePublish #> Displays a condensed table of all DNSSEC signing keys stored in the specified Active Directory database file. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADDBDnsServerSigningKey.md Export-ADDBDnsServerSigningKey Get-ADSIDnsServerSigningKey Get-ADDBDnsServerZone Get-ADDBDnsServerZone Get ADDBDnsServerZone Retrieves the list of DNS zones stored in an Active Directory database. This cmdlet retrieves the list of DNS zones that are stored in the specified Active Directory database file. This can be useful in some disaster recovery scenarios. Get-ADDBDnsServerZone DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ZoneName Restricts the output to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ZoneName Restricts the output to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None System.String DSInternals.Common.DNS.DnsZone -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBDnsServerZone -DatabasePath .\ntds.dit <# Sample Output: DistinguishedName : DC=_msdcs.contoso.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=contoso,DC=com ZoneName : _msdcs.contoso.com IsDsIntegrated : True IsReverseLookupZone : False IsSigned : False SignWithNSEC3 : False NSEC3CurrentSalt : DistinguishedName : DC=contoso.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=contoso,DC=com ZoneName : contoso.com IsDsIntegrated : True IsReverseLookupZone : False IsSigned : True SignWithNSEC3 : False NSEC3CurrentSalt : 879006FFA707C0F7 DistinguishedName : DC=adatum.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=contoso,DC=com ZoneName : adatum.com IsDsIntegrated : True IsReverseLookupZone : False IsSigned : False SignWithNSEC3 : False NSEC3CurrentSalt : DistinguishedName : DC=example.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=contoso,DC=com ZoneName : example.com IsDsIntegrated : True IsReverseLookupZone : False IsSigned : False SignWithNSEC3 : False NSEC3CurrentSalt : #> Retrieves the DNS zones from the specified Active Directory database file. -------------------------- Example 2 -------------------------- PS C:\> Get-ADDBDnsServerZone -DatabasePath .\ntds.dit | Format-Table <# Sample Output: ZoneName IsSigned IsReverseLookupZone -------- -------- ------------------- _msdcs.contoso.com False False contoso.com True False adatum.com False False example.com False False #> Displays a condensed table of the DNS zones stored in the specified Active Directory database file. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADDBDnsServerZone.md Get-ADDBDnsServerResourceRecord Get-ADDBDomainController Get-ADDBDomainController Get ADDBDomainController Reads information about the originating DC from a ntds.dit file, including domain name, domain SID, DC name, and DC site. Reads domain controller (DC) information from a ntds.dit file that is either retrieved from an offline DC or from an IFM backup. Get-ADDBDomainController DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None None DSInternals.PowerShell.DomainController -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBDomainController -DatabasePath .\ntds.dit <# Sample Output: Name : LON-DC1 DNSHostName : LON-DC1.contoso.com ServerReference : CN=LON-DC1,OU=Domain Controllers,DC=contoso,DC=com DomainName : contoso.com ForestName : contoso.com NetBIOSDomainName : contoso DomainSid : S-1-5-21-1236425271-2880748467-2592687428 DomainGuid : 262d915a-3c58-4614-86c0-f9fb3f1aa1cd Guid : 71ccee43-1c03-4ab1-910c-ed4168df5a33 Sid : S-1-5-21-1236425271-2880748467-2592687428-1111 DomainMode : WinThreshold ForestMode : WinThreshold SiteName : Default-First-Site-Name DsaGuid : 0a8574e2-9361-4f3c-8528-ca73d7534f4b InvocationId : 14a1b16d-591c-45bc-a342-153090027bbc IsADAM : False IsGlobalCatalog : True Options : GlobalCatalog OSName : Windows Server 2019 Datacenter OSVersion : 10.0 OSVersionMajor : 10 OSVersionMinor : 0 DomainNamingContext : DC=contoso,DC=com ConfigurationNamingContext : CN=Configuration,DC=contoso,DC=com SchemaNamingContext : CN=Schema,CN=Configuration,DC=contoso,DC=com WritablePartitions : {DC=contoso,DC=com, CN=Configuration,DC=contoso,DC=com, CN=Schema,CN=Configuration,DC=contoso,DC=com, DC=DomainDnsZones,DC=contoso,DC=com...} State : BackedUp HighestCommittedUsn : 69642 UsnAtIfm : BackupUsn : 65812 BackupExpiration : 2/4/2020 6:32:27 AM Epoch : 961 #> Reads DC information from a ntds.dit file located in the working directory. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADDBDomainController.md Set-ADDBDomainController Set-ADDBPrimaryGroup Add-ADDBSidHistory Get-ADDBKdsRootKey Get ADDBKdsRootKey Reads KDS Root Keys from a ntds.dit file. Can be used to aid DPAPI-NG decryption, e.g. SID-protected PFX files. KDS Root Keys are used to encrypt the following: - SID-protected private keys in PFX certificate files - BitLocker-enabled drives with SID protector - Passwords of Group Managed Service Accounts (gMSA) and Delegated Managed Service Accounts (dMSA) - DNSSEC key signing keys - Windows LAPS passwords Get-ADDBKdsRootKey All Indicates that all KDS Root Keys should be fetched. SwitchParameter False DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None Get-ADDBKdsRootKey RootKeyId Specifies a single KDS Root Key to be fetched. Guid Guid None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None All Indicates that all KDS Root Keys should be fetched. SwitchParameter SwitchParameter False DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None RootKeyId Specifies a single KDS Root Key to be fetched. Guid Guid None System.Guid DSInternals.Common.Data.KdsRootKey -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBKdsRootKey -DatabasePath '.\ADBackup\Active Directory\ntds.dit' <# Sample Output: Id: 6a401799-8dd0-0b2c-3073-beb7ce2e734d Version: 1 Creation Time: 7/27/2019 6:23:26 PM Effective Time: 7/27/2019 8:23:26 AM Domain Controller: CN=LON-DC1,OU=Domain Controllers,DC=contoso,DC=com Key C16A0D16B80307D9CF102C7DB11F69FE015EB0DCD85C2FC0A5005C10E9DB963AC1E18BF161882ABEEAFF1B01CD50076F3C6F7807323253AB9598DBE027A77DD7 Key Derivation Function Algorithm: SP800_108_CTR_HMAC Parameters: {[0, SHA512]} Secret Agreement Algorithm: DH Public Key Length: 2048 Private Key Length: 512 Parameters 0c0200004448504d0001000087a8e61db4b6663cffbbd19c651959998ceef608660dd0f25d2ceed4435e3b00e00df8f1d61957d4faf7df4561b2aa3016c3d91134096fa a3bf4296d830e9a7c209e0c6497517abd5a8a9d306bcf67ed91f9e6725b4758c022e0b1ef4275bf7b6c5bfc11d45f9088b941f54eb1e59bb8bc39a0bf12307f5c4fdb70 c581b23f76b63acae1caa6b7902d52526735488a0ef13c6d9a51bfa4ab3ad8347796524d8ef6a167b5a41825d967e144e5140564251ccacb83e6b486f6b3ca3f7971506 026c0b857f689962856ded4010abd0be621c3a3960a54e710c375f26375d7014103a4b54330c198af126116d2276e11715f693877fad7ef09cadb094ae91e1a15973fb3 2c9b73134d0b2e77506660edbd484ca7b18f21ef205407f4793a1a0ba12510dbc15077be463fff4fed4aac0bb555be3a6c1b0c6b47b1bc3773bf7e8c6f62901228f8c28 cbb18a55ae31341000a650196f931c77a57f2ddf463e5e9ec144b777de62aaab8a8628ac376d282d6ed3864e67982428ebc831d14348f6f2f9193b5045af2767164e1df c967c1fb3f2e55a4bd1bffe83b9c80d052b985d182ea0adb2a3b7313d3fe14c8484b1e052588b9b7d2bbd2df016199ecd06e1557cd0915b3353bbb64e0ec377fd028370 df92b52c7891428cdc67eb6184b523d1db246c32f63078490f00ef8d647d148d47954515e2327cfef98c582664b4c0f6cc41659 #> PS C:\> .\CQDPAPINGPFXDecrypter.exe /pfx Certificate.p12 /master C16A0D16B80307D9CF102C7DB11F69FE015EB0DCD85C2FC0A5005C10E9DB963AC1E18BF161882ABEEAFF1B01CD50076F3C6F7807323253AB9598DBE027A77DD7 <# Sample Output: Successfully decrypted password: VBGpKPryuiWBSyq/+CjC0WjNsnZ1xS3Hs6IqGZwa0BM= #> Retrieves a KDS Root Key from an AD database and then uses the "CQURE DPAPI NG PFX Decrypter" to decrypt the password of the PFX file. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADDBKdsRootKey.md Get-ADDBServiceAccount Get-ADReplKdsRootKey Get-ADSIKdsRootKey Get-ADDBSchemaAttribute Get ADDBSchemaAttribute Reads AD schema from a ntds.dit file, including datatable column names. Reads Active Directory schema from a ntds.dit file and returns the list of attributes, including their datatable column names and indices. Get-ADDBSchemaAttribute Name Specifies the name of a specific attribute to retrieve. String[] String[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None Name Specifies the name of a specific attribute to retrieve. String[] String[] None System.String[] DSInternals.Common.Schema.AttributeSchema -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBSchemaAttribute -DatabasePath 'C:\ADBackup\ntds.dit' | Select-Object -Property ColumnName,Name,AttributeOid,IndexName <# Sample Output: ColumnName Name AttributeOid IndexName ---------- ---- ------------ --------- ATTm3 cn 2.5.4.3 INDEX_00000003 ATTm590045 sAMAccountName 1.2.840.113556.1.4.221 INDEX_000900DD ATTj590126 sAMAccountType 1.2.840.113556.1.4.302 INDEX_0009012E ... #> Analyzes the internal database schema of the specified ntds.dit file. The results are redacted. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADDBSchemaAttribute.md Get-ADDBDomainController Get-ADDBServiceAccount Get ADDBServiceAccount Reads all Group Managed Service Accounts (gMSAs) and Delegated Managed Service Accounts (dMSAs) from a ntds.dit file, while deriving their current passwords from KDS root keys. As none of the required information is encrypted, the BootKey is not required. Does not work on database files from RODCs though. Get-ADDBServiceAccount DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None EffectiveTime Specifies the date and time at which the generated credentials should be valid. Defaults to the current time. DateTime DateTime [datetime]::Now LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None EffectiveTime Specifies the date and time at which the generated credentials should be valid. Defaults to the current time. DateTime DateTime [datetime]::Now LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None None DSInternals.Common.Data.GroupManagedServiceAccount -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBServiceAccount -DatabasePath 'C:\ADBackup\ntds.dit' <# Sample Output: DistinguishedName: CN=svc_adfs,CN=Managed Service Accounts,DC=contoso,DC=com Sid: S-1-5-21-2468531440-3719951020-3687476655-1109 Guid: 53c845f7-d9cd-471b-a364-e733641dcc86 SamAccountName: svc_adfs$ Description: ADFS Service Account Enabled: True Deleted: False UserAccountControl: WorkstationAccount SupportedEncryptionTypes: RC4_HMAC, AES128_CTS_HMAC_SHA1_96, AES256_CTS_HMAC_SHA1_96 ServicePrincipalName: {http/login.contoso.com, host/login.contoso.com} WhenCreated: 9/9/2023 5:02:05 PM PasswordLastSet: 9/9/2023 5:02:06 PM ManagedPasswordInterval: 30 ManagedPasswordId: RootKey=7dc95c96-fa85-183a-dff5-f70696bf0b11, Cycle=9/9/2023 10:00:00 AM (L0=361, L1=26, L2=24) ManagedPasswordPreviousId: KDS Derived Secrets (Calculated) EffectivePasswordId: RootKey=7dc95c96-fa85-183a-dff5-f70696bf0b11, Cycle=6/25/2025 8:00:00 PM (L0=363, L1=11, L2=29) NTHash: 0b5fbfb646dd7bce4f160ad69edb86ba Kerberos Keys AES256_CTS_HMAC_SHA1_96 Key: 5dcc418cd0a30453b267e6e5b158be4b4d80d23fd72a6ae4d5bd07f023517117 Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 8e1e66438a15d764ae2242eefd15e09a Iterations: 4096 #> Reads all Group Managed Service Accounts (gMSAs) from the specified ntds.dit file, while deriving their current passwords from KDS root keys. -------------------------- Example 2 -------------------------- PS C:\> Get-ADDBServiceAccount -EffectiveTime (Get-Date).AddMonths(1) -DatabasePath 'C:\ADBackup\ntds.dit' Reads all Group Managed Service Accounts (gMSAs) from the specified ntds.dit file, while deriving their future passwords from KDS root keys. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADDBServiceAccount.md Get-ADDBKdsRootKey Get-ADDBAccount Get-ADDBTrust Get ADDBTrust Reads inter-domain trust objects from a ntds.dit and decrypts the trust passwords. Reads all AD forest and MIT realm trust objects from the specified ntds.dit file. The cmdlet decrypts the trust passwords and derives the Kerberos trust keys. Get-ADDBTrust BootKey Specifies the boot key (AKA system key) that will be used to decrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None BootKey Specifies the boot key (AKA system key) that will be used to decrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None None DSInternals.Common.Kerberos.TrustedDomain -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBTrust -DatabasePath 'C:\ADBackup\ntds.dit' -BootKey c53a1d6ce3b391432863073cea763915 <# Sample Output: DistinguishedName: CN=adatum.com,CN=System,DC=contoso,DC=com TrustPartner: adatum.com FlatName: adatum Sid: S-1-5-21-2072939287-465948493-1385512467 Direction: Bidirectional Source: contoso.com SourceFlatName: contoso Type: Uplevel Attributes: ForestTransitive SupportedEncryptionTypes: AES128_CTS_HMAC_SHA1_96, AES256_CTS_HMAC_SHA1_96 Deleted: False TrustAuthIncoming CurrentPassword: 鑵׶肞뚙ᝑ꣤ς搏ﴲᛍ⨾녰钳맦 CurrentNTHash: a00b29a3ab2fe08bf169096798193290 PreviousPassword: Pa$$w0rd PreviousNTHash: 92937945b518814341de3f726500d4ff IncomingTrustKeys (Calculated) Credentials: AES256_CTS_HMAC_SHA1_96 Key: f253328c380a20b24c59866ab5a4f222a7fdec9de05502b261de6bbccd392da9 Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 039d99f0b5c78bd7d07e0fed28fe2cf8 Iterations: 4096 DES_CBC_MD5 Key: 0ee92c61b66b5d0d Iterations: 4096 OldCredentials: AES256_CTS_HMAC_SHA1_96 Key: ab18197b48942fcbb8dab398f1b78fcbad8a223ff6779eb332f42f21655f5aa0 Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 676c6a1e69f0ec7d78010e75e9c24b6f Iterations: 4096 DES_CBC_MD5 Key: 2afbc7d94fa4ab29 Iterations: 4096 OlderCredentials: ServiceCredentials: Salt: CONTOSO.COMkrbtgtadatum DefaultIterationCount: 4096 Flags: 0 TrustAuthOutgoing CurrentPassword: 쩘僞◀ꝵ黠鯹안꽾仈퍯䢥鉑꾲 CurrentNTHash: ea1d78e82a3e496eb65ccd9a108575d0 PreviousPassword: Pa$$w0rd PreviousNTHash: 92937945b518814341de3f726500d4ff OutgoingTrustKeys (Calculated) Credentials: AES256_CTS_HMAC_SHA1_96 Key: 25668ca9f03154e3cf0509a01f51bb3a5fcac8200e69eb542e6f2ad4609d39ce Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 65a4c7a238f2cf8146f15db4dfda4bad Iterations: 4096 DES_CBC_MD5 Key: d90425dc58571a86 Iterations: 4096 OldCredentials: AES256_CTS_HMAC_SHA1_96 Key: 214a5078f4fdb6405ca669a4ce9662cb631989d331585ce115c769c7218f6583 Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: efc764b4de373d40c3e9b173c0ee3a47 Iterations: 4096 DES_CBC_MD5 Key: 9ec1cbd9163da72a Iterations: 4096 OlderCredentials: ServiceCredentials: Salt: ADATUM.COMkrbtgtcontoso DefaultIterationCount: 4096 Flags: 0 DistinguishedName: CN=MIT.EDU,CN=System,DC=contoso,DC=com TrustPartner: MIT.EDU FlatName: MIT.EDU Sid: Direction: Outbound Source: contoso.com SourceFlatName: contoso Type: MIT Attributes: DisallowTransivity SupportedEncryptionTypes: Deleted: False TrustAuthIncoming CurrentPassword: CurrentNTHash: PreviousPassword: PreviousNTHash: IncomingTrustKeys (Calculated) TrustAuthOutgoing CurrentPassword: Pa$$w0rd CurrentNTHash: 92937945b518814341de3f726500d4ff PreviousPassword: Pa$$w0rd PreviousNTHash: 92937945b518814341de3f726500d4ff OutgoingTrustKeys (Calculated) Credentials: AES256_CTS_HMAC_SHA1_96 Key: 86382b311288ae8e1bf0157ac93849ae4f4f84a9a2e71aea57c2a8936067f486 Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: b28d2d6afd811c05de733ae143cf9d06 Iterations: 4096 DES_CBC_MD5 Key: 3bd940c1f79b79ce Iterations: 4096 OldCredentials: AES256_CTS_HMAC_SHA1_96 Key: 86382b311288ae8e1bf0157ac93849ae4f4f84a9a2e71aea57c2a8936067f486 Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: b28d2d6afd811c05de733ae143cf9d06 Iterations: 4096 DES_CBC_MD5 Key: 3bd940c1f79b79ce Iterations: 4096 OlderCredentials: ServiceCredentials: Salt: MIT.EDUkrbtgtcontoso DefaultIterationCount: 4096 Flags: 0 #> Reads all AD forest and MIT realm trust objects from the specified ntds.dit file. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADDBTrust.md Get-ADDBAccount Get-ADKeyCredential Get ADKeyCredential Creates an object representing Windows Hello for Business or FIDO credentials from its binary representation or an X.509 certificate. This cmdlet can be used to display existing key credentials from Active Directory (including NGC, STK and FIDO keys) and to generate new NGC credentials from self-signed certificates. See the examples for more info. Get-ADKeyCredential BinaryData Specifies the credentials in binary/hexadecimal format. Byte[] Byte[] None OwnerDN Specifies the distinguished name (DN) of the object that these credentials are associated with. String String None Get-ADKeyCredential Certificate Specifies a certificate that wraps an NGC key. X509Certificate2 X509Certificate2 None DeviceId Specifies an identifier (typically objectGUID) of the associated computer. Guid Guid None CreationTime Specifies the time when the key was created. Default value is the current time. DateTime DateTime None OwnerDN Specifies the distinguished name (DN) of the object that these credentials are associated with. String String None Get-ADKeyCredential Certificate Specifies a certificate that wraps an NGC key. X509Certificate2 X509Certificate2 None CreationTime Specifies the time when the key was created. Default value is the current time. DateTime DateTime None IsComputerKey Indicates that the resulting key credential must meet the DS-Validated-Write-Computer requirements. SwitchParameter False OwnerDN Specifies the distinguished name (DN) of the object that these credentials are associated with. String String None Get-ADKeyCredential DNWithBinaryData Specifies the credentials in the DN-Binary syntax. String[] String[] None BinaryData Specifies the credentials in binary/hexadecimal format. Byte[] Byte[] None Certificate Specifies a certificate that wraps an NGC key. X509Certificate2 X509Certificate2 None CreationTime Specifies the time when the key was created. Default value is the current time. DateTime DateTime None DeviceId Specifies an identifier (typically objectGUID) of the associated computer. Guid Guid None DNWithBinaryData Specifies the credentials in the DN-Binary syntax. String[] String[] None IsComputerKey Indicates that the resulting key credential must meet the DS-Validated-Write-Computer requirements. SwitchParameter SwitchParameter False OwnerDN Specifies the distinguished name (DN) of the object that these credentials are associated with. String String None System.String[] DSInternals.Common.Data.KeyCredential -------------------------- Example 1 -------------------------- PS C:\> Get-ADObject -LDAPFilter '(msDS-KeyCredentialLink=*)' -Properties msDS-KeyCredentialLink | Select-Object -ExpandProperty msDS-KeyCredentialLink | Get-ADKeyCredential <# Sample Output: Usage Source Flags DeviceId Created Owner ----- ------ ----- -------- ------- ----- NGC AD None cfe9a872-13ff-4751-a777-aec88c30a762 2019-08-01 CN=John Doe,CN=Users,DC=contoso,DC=com STK AD None 2017-08-23 CN=PC01,CN=Computers,DC=contoso,DC=com NGC AD MFANotUsed 2017-08-23 CN=PC02,CN=Computers,DC=contoso,DC=com NGC AzureAD None fd591087-245c-4ff5-a5ea-c14de5e2b32d 2017-07-19 CN=John Doe,CN=Users,DC=contoso,DC=com FIDO AzureAD Attestation 00000000-0000-0000-0000-000000000000 2019-08-26 CN=John Doe,CN=Users,DC=contoso,DC=com #> Lists all key credentials that are registered in Active Directory. -------------------------- Example 2 -------------------------- PS C:\> Get-ADObject -LDAPFilter '(msDS-KeyCredentialLink=*)' -Properties msDS-KeyCredentialLink | Select-Object -ExpandProperty msDS-KeyCredentialLink | Get-ADKeyCredential | Where-Object Usage -eq NGC | Format-Table -View ROCA <# Sample Output: Usage IsWeak Source DeviceId Created Owner ----- ------ ------ -------- ------- ----- NGC True AzureAD fd591087-245c-4ff5-a5ea-c14de5e2b32d 2017-07-19 CN=John Doe,CN=Users,DC=contoso,DC=com NGC False AD 1966d4da-14da-4581-a7a7-5e8e07e93ad9 2019-08-01 CN=Jane Doe,CN=Users,DC=contoso,DC=com #> Lists weak public keys registered in Active Directory that were generated on ROCA-vulnerable TPMs. -------------------------- Example 3 -------------------------- PS C:\> Get-ADObject -LDAPFilter '(msDS-KeyCredentialLink=*)' -Properties msDS-KeyCredentialLink | Select-Object -ExpandProperty msDS-KeyCredentialLink | Get-ADKeyCredential | Where-Object Usage -eq NGC | Format-Custom -View Moduli | Out-File -FilePath .\moduli.txt -Encoding ascii -Force Exports all RSA public key moduli from NGC keys to a file in BASE64 encoding. This format is supported by the original Python ROCA Detection Tool. -------------------------- Example 4 -------------------------- PS C:\> Get-ADObject -LDAPFilter '(msDS-KeyCredentialLink=*)' -Properties msDS-KeyCredentialLink | Select-Object -ExpandProperty msDS-KeyCredentialLink | Get-ADKeyCredential | Where-Object Usage -eq FIDO | Format-Table -View FIDO <# Sample Output: DisplayName AAGUID Alg Counter Created Owner ----------- ------ --- ------- ------- ----- eWMB Goldengate G320 87dbc5a1-4c94-4dc8-8a47-97d800fd1f3c ES256 37 2019-08-29 CN=John Doe,CN=Users,DC=contoso,DC=com eWBM Goldengate G310 95442b2e-f15e-4def-b270-efb106facb4e ES256 48 2019-08-29 CN=John Doe,CN=Users,DC=contoso,DC=com Yubikey 5 cb69481e-8ff7-4039-93ec-0a2729a154a8 ES256 25 2019-06-21 CN=John Doe,CN=Users,DC=contoso,DC=com Feitian All-In-Pass 12ded745-4bed-47d4-abaa-e713f51d6393 ES256 1398 2020-03-31 CN=John Doe,CN=Users,DC=contoso,DC=com #> Lists FIDO tokens registered in Active Directory. -------------------------- Example 5 -------------------------- PS C:\> Get-ADUser -Identity john -Properties msDS-KeyCredentialLink | Select-Object -ExpandProperty msDS-KeyCredentialLink | Get-ADKeyCredential | Out-GridView -OutputMode Multiple -Title 'Select a credentials for removal...' | ForEach-Object { Set-ADObject -Identity $PSItem.Owner -Remove @{ 'msDS-KeyCredentialLink' = $PSItem.ToDNWithBinary() } } Selectively deletes key credentials from Active Directory. -------------------------- Example 6 -------------------------- PS C:\> $upn = 'john@contoso.com' PS C:\> $userSid = 'S-1-5-21-1236425271-2880748467-2592687428-1109' PS C:\> $certificateSubject = '{0}/{1}/login.windows.net/383a3889-5bc9-47a3-846c-2b70f0b7fe0e/{2}' -f $userSid, (New-Guid), $upn PS C:\> $certificate = New-SelfSignedCertificate -Subject $certificateSubject ` -KeyLength 2048 ` -Provider 'Microsoft Strong Cryptographic Provider' ` -CertStoreLocation Cert:\CurrentUser\My ` -NotAfter (Get-Date).AddYears(30) ` -TextExtension '2.5.29.19={text}false', '2.5.29.37={text}1.3.6.1.4.1.311.20.2.2' ` -SuppressOid '2.5.29.14' ` -KeyUsage None ` -KeyExportPolicy Exportable PS C:\> $ngcKey = Get-ADKeyCredential -Certificate $certificate -DeviceId (New-Guid) -OwnerDN 'CN=John Doe,CN=Users,DC=contoso,DC=com' PS C:\> Set-ADObject -Identity $ngcKey.Owner -Add @{ 'msDS-KeyCredentialLink' = $ngcKey.ToDNWithBinary() } Generates a new NGC key for a user account and registers it in Active Directory. Note that the value of the certificate Subject has no effect on the functionality, but as it appears in DC logs, this example uses the same format as Windows does. -------------------------- Example 7 -------------------------- PS C:\> $certificate = New-SelfSignedCertificate -Subject 'S-1-5-21-1236425271-2880748467-2592687428-1001' ` -KeyLength 2048 ` -Provider 'Microsoft Strong Cryptographic Provider' ` -CertStoreLocation Cert:\LocalMachine\My ` -NotAfter (Get-Date).AddYears(30) ` -TextExtension '2.5.29.19={text}false', '2.5.29.37={text}1.3.6.1.4.1.311.20.2.2' ` -SuppressOid '2.5.29.14' ` -KeyUsage None ` -KeyExportPolicy Exportable PS C:\> $ngcKey = Get-ADKeyCredential -IsComputerKey -Certificate $certificate -OwnerDN 'CN=PC01,CN=Computers,DC=contoso,DC=com' PS C:\> Set-ADComputer -Identity 'PC01$' -Clear msDS-KeyCredentialLink -Add @{ 'msDS-KeyCredentialLink' = $ngcKey.ToDNWithBinary() } Performs a validated write of computer NGC key. Must be executed under the computer account's identity. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADKeyCredential.md Add-ADReplNgcKey Get-ADReplAccount Get-ADDBAccount Get-ADReplAccount Get ADReplAccount Reads one or more accounts through the MS-DRSR protocol, including secret attributes. Reads one or more accounts from a target Active Directory domain controller through the MS-DRSR protocol, including secret attributes. Get-ADReplAccount All Indidates that all accounts will be replicated from the target domain controller. SwitchParameter False Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None ExportFormat Specifies the format in which the account information will be displayed. JohnNT JohnNTHistory JohnLM JohnLMHistory HashcatNT HashcatNTHistory HashcatLM HashcatLMHistory NTHash NTHashHistory LMHash LMHashHistory Ophcrack PWDump PWDumpHistory AccountExportFormat AccountExportFormat None NamingContext Specifies the naming context root of the replica to replicate. String String None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Get-ADReplAccount DistinguishedName Specifies the identifier of the account that will be replicated. String String None Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None ExportFormat Specifies the format in which the account information will be displayed. JohnNT JohnNTHistory JohnLM JohnLMHistory HashcatNT HashcatNTHistory HashcatLM HashcatLMHistory NTHash NTHashHistory LMHash LMHashHistory Ophcrack PWDump PWDumpHistory AccountExportFormat AccountExportFormat None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Get-ADReplAccount SamAccountName Specifies the identifier of the account that will be replicated. String String None Domain Specifies the NetBIOS domain name of the account that will be replicated. String String None Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None ExportFormat Specifies the format in which the account information will be displayed. JohnNT JohnNTHistory JohnLM JohnLMHistory HashcatNT HashcatNTHistory HashcatLM HashcatLMHistory NTHash NTHashHistory LMHash LMHashHistory Ophcrack PWDump PWDumpHistory AccountExportFormat AccountExportFormat None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Get-ADReplAccount Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None ExportFormat Specifies the format in which the account information will be displayed. JohnNT JohnNTHistory JohnLM JohnLMHistory HashcatNT HashcatNTHistory HashcatLM HashcatLMHistory NTHash NTHashHistory LMHash LMHashHistory Ophcrack PWDump PWDumpHistory AccountExportFormat AccountExportFormat None ObjectGuid Specifies the identifier of the account that will be replicated. Guid Guid None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Get-ADReplAccount Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None ExportFormat Specifies the format in which the account information will be displayed. JohnNT JohnNTHistory JohnLM JohnLMHistory HashcatNT HashcatNTHistory HashcatLM HashcatLMHistory NTHash NTHashHistory LMHash LMHashHistory Ophcrack PWDump PWDumpHistory AccountExportFormat AccountExportFormat None ObjectSid Specifies the identifier of the account that will be replicated. SecurityIdentifier SecurityIdentifier None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Get-ADReplAccount Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None ExportFormat Specifies the format in which the account information will be displayed. JohnNT JohnNTHistory JohnLM JohnLMHistory HashcatNT HashcatNTHistory HashcatLM HashcatLMHistory NTHash NTHashHistory LMHash LMHashHistory Ophcrack PWDump PWDumpHistory AccountExportFormat AccountExportFormat None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None UserPrincipalName Specifies the identifier of the account that will be replicated. String String None All Indidates that all accounts will be replicated from the target domain controller. SwitchParameter SwitchParameter False Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None DistinguishedName Specifies the identifier of the account that will be replicated. String String None Domain Specifies the NetBIOS domain name of the account that will be replicated. String String None ExportFormat Specifies the format in which the account information will be displayed. AccountExportFormat AccountExportFormat None NamingContext Specifies the naming context root of the replica to replicate. String String None ObjectGuid Specifies the identifier of the account that will be replicated. Guid Guid None ObjectSid Specifies the identifier of the account that will be replicated. SecurityIdentifier SecurityIdentifier None Properties Specifies the set of properties that will be retrieved for each account. AccountPropertySets AccountPropertySets All SamAccountName Specifies the identifier of the account that will be replicated. String String None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None UserPrincipalName Specifies the identifier of the account that will be replicated. String String None System.String System.Security.Principal.SecurityIdentifier System.Guid DSInternals.Common.Data.DSAccount DSInternals.Common.Data.DSUser DSInternals.Common.Data.DSComputer -------------------------- Example 1 -------------------------- PS C:\> Get-ADReplAccount -SamAccountName joe -Server 'lon-dc1.contoso.com' <# Sample Output: DistinguishedName: CN=Joe Smith,OU=Employees,DC=contoso,DC=com SamAccountName: joe UserPrincipalName: joe@contoso.com Enabled: True Deleted: False Sid: S-1-5-21-1236425271-2880748467-2592687428-1110 Guid: 6fb7aca4-fe85-4dc5-9acd-b5b2529fe2bc SamAccountType: User UserAccountControl: NormalAccount, PasswordNeverExpires Description: Joe's standard account Notes: Lorem Ipsum AdminCount: False PrimaryGroupId: 513 SidHistory: SupportedEncryptionTypes: Default ServicePrincipalName: LastLogonDate: 2/23/2015 10:27:18 AM PasswordLastSet: 7/11/2014 11:35:47 AM SecurityDescriptor: DiscretionaryAclPresent, SystemAclPresent, DiscretionaryAclAutoInherited, SystemAclAutoInherited, SelfRelative GivenName: Joe Surname: Smith Initials: RR DisplayName: Joe Smith Email: joe@contoso.com StreetAddress: 1 Microsoft Way City: Redmond PostalCode: 98052 State: Washington Country: US Office: A309 TelephoneNumber: 0118 999 881 999 119 7253 Mobile: (312) 555-0690 HomePhone: (408) 555-1439 Company: Contoso Department: IT JobTitle: Admin EmployeeID: EmployeeNumber: ProfilePath: ScriptPath: Key Credentials Usage=NGC, Source=ActiveDirectory, Device=1966d4da-14da-4581-a7a7-5e8e07e93ad9, Created=8/1/2019 10:53:12 PM, LastLogon=8/1/2019 10:53:12 PM Usage=NGC, Source=ActiveDirectory, Device=cfe9a872-13ff-4751-a777-aec88c30a762, Created=8/1/2019 11:09:15 PM, LastLogon=8/1/2019 11:09:15 PM Credential Roaming Created: 3/12/2017 9:15:56 AM Modified: 3/13/2017 10:01:18 AM Credentials: DPAPIMasterKey: joe\Protect\S-1-5-21-1236425271-2880748467-2592687428-1110\47070660-c259-4d90-8bc9-187605323450 DPAPIMasterKey: joe\Protect\S-1-5-21-1236425271-2880748467-2592687428-1110\7fc19508-7b85-4a7c-9e5d-15f9e00e7ce5 CryptoApiCertificate: joe\SystemCertificates\My\Certificates\574E4687133998544C0095C7B348C52CD398182E CNGCertificate: joe\SystemCertificates\My\Certificates\3B83BFA7037F6A79B3F3D17D229E1BC097F35B51 RSAPrivateKey: joe\Crypto\RSA\S-1-5-21-1236425271-2880748467-2592687428-1110\701577141985b6923998dcca035c007a_f8b7bbef-d227-4ac7-badd-3a238a7f741e CNGPrivateKey: joe\Crypto\Keys\E8F13C2BA0209401C4DFE839CD57375E26BBE38F Secrets NTHash: 92937945b518814341de3f726500d4ff LMHash: NTHashHistory: Hash 01: 92937945b518814341de3f726500d4ff LMHashHistory: Hash 01: 30ce97eef1084cf1656cc4be70d68600 SupplementalCredentials: ClearText: NTLMStrongHash: 2c6d57beebeafdae65b3f40f2a0d5430 Kerberos: Credentials: DES_CBC_MD5 Key: 7f16bc4ada0b8a52 OldCredentials: Salt: CONTOSO.COMjoe Flags: 0 KerberosNew: Credentials: AES256_CTS_HMAC_SHA1_96 Key: cd541be0838c787b5c6a34d7b19274aee613545a0e6cc6f5ac5918d8a464d24f Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 5c88972747bd454704c117ae52c474e4 Iterations: 4096 DES_CBC_MD5 Key: 7f16bc4ada0b8a52 Iterations: 4096 OldCredentials: OlderCredentials: ServiceCredentials: Salt: CONTOSO.COMjoe DefaultIterationCount: 4096 Flags: 0 WDigest: Hash 01: 61fed940f0e8d03a49d3727f55800497 Hash 02: a1d54499dda6a6b5431f29a8d741a640 Hash 03: b6cdf00bc0c4578992f718de81251721 Hash 04: 61fed940f0e8d03a49d3727f55800497 Hash 05: a1d54499dda6a6b5431f29a8d741a640 Hash 06: 9a8991bd99763df2e37f1e1e67d71cc8 Hash 07: 61fed940f0e8d03a49d3727f55800497 Hash 08: 8a9fe94883c8ccf3bcfc6591ddd2288f Hash 09: 8a9fe94883c8ccf3bcfc6591ddd2288f Hash 10: 1b7b16b49ecd8d9d59c1d0db6fa2cc36 Hash 11: d4c24695cfa4dc3810a469d5efb8ecaf Hash 12: 8a9fe94883c8ccf3bcfc6591ddd2288f Hash 13: a5b8aa5088280298c8c27fa99dcaa1e3 Hash 14: d4c24695cfa4dc3810a469d5efb8ecaf Hash 15: 1aa8e567622fe53d6fb36f1f34f12aaa Hash 16: 1aa8e567622fe53d6fb36f1f34f12aaa Hash 17: 2af425244079f8f45927c34fa115e45b Hash 18: cf283a35102b820e25003b1ddf270221 Hash 19: b98c902c57449253e6f06b5d585866bd Hash 20: 2a690b1eeda9cb8f3157a4a3ba0be9c3 Hash 21: af2654776d5f9f27f3283ecb0aa25011 Hash 22: af2654776d5f9f27f3283ecb0aa25011 Hash 23: ba6fe0513ed2a60ec253a41bbde6a837 Hash 24: 8bf5a67b598087be948e040f85c72b4d Hash 25: 8bf5a67b598087be948e040f85c72b4d Hash 26: aa5ff46d23a5c7ebd603e1793225350d Hash 27: 656b6a7f5b52d05b3ce9168a2b7ac8ac Hash 28: ae884c92ecd87e8d54f1844f09c5a519 Hash 29: a500a9e26afc9f817df8a07e15771577 #> Replicates a single Active Directory user account from the target domain controller. -------------------------- Example 2 -------------------------- PS C:\> Get-ADReplAccount -SamAccountName 'PC01$' -Server 'lon-dc1.contoso.com' <# Sample Output: DistinguishedName: CN=PC01,CN=Computers,DC=contoso,DC=com SamAccountName: PC01$ Enabled: True Deleted: False Sid: S-1-5-21-2072841070-1873892158-2095746001-1104 Guid: 34017f6d-a264-4681-8738-09780122884f SamAccountType: Computer UserAccountControl: WorkstationAccount DNSHostName: PC01.contoso.com OperatingSystem: Windows 11 Enterprise OperatingSystemVersion: 10.0 (26100) Description: John's computer PrimaryGroupId: 515 Location: USA/WA/Seattle SidHistory: SupportedEncryptionTypes: RC4_HMAC, AES128_CTS_HMAC_SHA1_96, AES256_CTS_HMAC_SHA1_96 ServicePrincipalName: {HOST/PC01.contoso.com, RestrictedKrbHost/PC01.contoso.com, HOST/PC01, RestrictedKrbHost/PC01...} LastLogonDate: 1/27/2025 9:22:36 AM PasswordLastSet: 1/22/2025 9:23:45 PM SecurityDescriptor: DiscretionaryAclPresent, SystemAclPresent, DiscretionaryAclAutoInherited, SystemAclAutoInherited, SelfRelative LAPS Key Credentials Usage: NGC, Source: AD, Device: , Created: 11/23/2024 10:58:30 PM Secrets NTHash: 0ec8485560274b5352fab8085f83f5cf LMHash: NTHashHistory: Hash 01: 0ec8485560274b5352fab8085f83f5cf Hash 02: d3981b0fa179f60b3eac48ea0aa06b62 Hash 03: f6ab2345d24e09993c972087d189a365 LMHashHistory: Hash 01: ecb0097500ffd72b005071e31a237ed5 Hash 02: 1d16a311401fba1f5d95090cb4fcacdb Hash 03: 1224652b76e22751d79a06a7ce796e56 SupplementalCredentials: ClearText: NTLMStrongHash: Kerberos: KerberosNew: Credentials: AES256_CTS_HMAC_SHA384_192 Key: f97e0809c70a0c88aa5e6bc2d891f44e56ded641425a9bb0e9468f83a89b23d1 Iterations: 4096 AES128_CTS_HMAC_SHA256_128 Key: b5bf869da88f6d23c7a7e0585fc4d385 Iterations: 4096 AES256_CTS_HMAC_SHA1_96 Key: 099378565ec8edb5be48624bf1af8569c63963a28cb5a2e165668b618bb39d0c Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 483599c78841e3d14c91283a33ceaa38 Iterations: 4096 RC4_HMAC_NT Key: 0ec8485560274b5352fab8085f83f5cf Iterations: 4096 OldCredentials: AES256_CTS_HMAC_SHA384_192 Key: ab6e6e6c22a3689cccfaee4a46744cd5fa25b466992246b9d5474090dc6a6d32 Iterations: 4096 AES128_CTS_HMAC_SHA256_128 Key: cca81c6d197a8619f81d67db8b2f510f Iterations: 4096 AES256_CTS_HMAC_SHA1_96 Key: 7a59559a82e25d7c3b11ba9746a0af776905d404e17c07be9dc7f45689600017 Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 6203b2af5353b22f7948f4dc393fc2e3 Iterations: 4096 RC4_HMAC_NT Key: d3981b0fa179f60b3eac48ea0aa06b62 Iterations: 4096 OlderCredentials: AES256_CTS_HMAC_SHA384_192 Key: 662eb233817c7f92fe89d956b66522193848c94851176a962c76092932e195bd Iterations: 4096 AES128_CTS_HMAC_SHA256_128 Key: 36b9535feaf1127aa3f7b4940345b6b9 Iterations: 4096 AES256_CTS_HMAC_SHA1_96 Key: 3bed800004f155ad9d7b7492ca1b4902b3dca64dbca503b94d8cdc622b3a69aa Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 29f2bbec3fb8a177c788afc4c24d368a Iterations: 4096 RC4_HMAC_NT Key: f6ab2345d24e09993c972087d189a365 Iterations: 4096 ServiceCredentials: AES256_CTS_HMAC_SHA384_192 Key: f97e0809c70a0c88aa5e6bc2d891f44e56ded641425a9bb0e9468f83a89b23d1 Iterations: 4096 AES128_CTS_HMAC_SHA256_128 Key: b5bf869da88f6d23c7a7e0585fc4d385 Iterations: 4096 AES256_CTS_HMAC_SHA1_96 Key: 099378565ec8edb5be48624bf1af8569c63963a28cb5a2e165668b618bb39d0c Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 483599c78841e3d14c91283a33ceaa38 Iterations: 4096 Salt: CONTOSO.COMhostpc01.contoso.com DefaultIterationCount: 4096 Flags: 0 WDigest: Hash 01: 51ec1c08dc1515d691f86c35efd6951a Hash 02: 0804fe417162838cee1b585e05403c7e Hash 03: 51ec1c08dc1515d691f86c35efd6951a Hash 04: 51ec1c08dc1515d691f86c35efd6951a Hash 05: f7dfe69378cd20462567a3f12d306d9c Hash 06: f7dfe69378cd20462567a3f12d306d9c Hash 07: 84d3754825bb778f150e2e0f9e0ad791 Hash 08: c3f6531e37407660f4eaab3685b10c77 Hash 09: 7c9c69f0f4af01f24d00cd7fd40f0ad8 Hash 10: abbb73611689c4726a81d89adbb58a76 Hash 11: abbb73611689c4726a81d89adbb58a76 Hash 12: c3f6531e37407660f4eaab3685b10c77 Hash 13: c3f6531e37407660f4eaab3685b10c77 Hash 14: 2597e2d6baeb6a27746efa36afb108ce Hash 15: b7e76a5d9451f3e9dbfcbab122dde4a7 Hash 16: 299ed0932d98d3c08f0037402cc4b025 Hash 17: 13188b1800edb36ce4a5ebae8bdc163d Hash 18: cd9d520759c3919e442437eb84d3fecf Hash 19: 7eb065737a969f09daf7650ca1aa9441 Hash 20: cd9d520759c3919e442437eb84d3fecf Hash 21: b491f3531400f2a25ac123c74f698109 Hash 22: 55ab8a2e40e730d1d7426d5b71842021 Hash 23: b491f3531400f2a25ac123c74f698109 Hash 24: eec9350591609e3caef02e6ebc5b5da5 Hash 25: 9046b70b3f463105ac60d72d14d083ee Hash 26: 45a252b159aec8f9e6a6c18dac468b47 Hash 27: a5e2fb397f93c24f53c055bb8e38975a Hash 28: db978e9c18bca0774a2b53ddf9c20d45 Hash 29: a5e2fb397f93c24f53c055bb8e38975a #> Replicates a single Active Directory computer account from the target domain controller. -------------------------- Example 3 -------------------------- PS C:\> $accounts = Get-ADReplAccount -All -Server 'lon-dc1.contoso.com' Replicates all Active Directory accounts from the target domain controller. -------------------------- Example 4 -------------------------- PS C:\> $results = Get-ADReplAccount -All -Server 'lon-dc1.contoso.com' -Properties Secrets | Test-PasswordQuality -WeakPasswordHashesSortedFile pwned-passwords-ntlm-ordered-by-hash-v5.txt Performs an online credential hygiene audit of AD against HIBP. -------------------------- Example 5 -------------------------- PS C:\> Get-ADReplAccount -All -Server LON-DC1 -ExportFormat PwDump | Where-Object SamAccountType -eq User | Where-Object Enabled -eq $true | Where-Object NTHash -ne $null | Out-File -FilePath users.pwdump -Encoding ascii Replicates all Active Directory accounts from the target domain controller and exports their NT and LM password hashes to a pwdump file. -------------------------- Example 6 -------------------------- PS C:\> Get-ADReplBackupKey -Server 'lon-dc1.adatum.com' | Save-DpapiBlob -DirectoryPath '.\Output' PS C:\> Get-ADReplAccount -All -Server 'lon-dc1.adatum.com' -Properties RoamedCredentials | Save-DpapiBlob -DirectoryPath '.\Output' Replicates all DPAPI backup keys and roamed credentials (certificates, private keys, and DPAPI master keys) from the target Active Directory domain controller and saves them to the Output directory. Also creates a file called kiwiscript.txt that contains mimikatz commands needed to decrypt the private keys. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADReplAccount.md Get-ADDBAccount Get-ADSIAccount Test-PasswordQuality Save-DpapiBlob Get-ADReplBackupKey Get ADReplBackupKey Reads the DPAPI backup keys from a domain controller through the MS-DRSR protocol. Replicates the Data Protection API (DPAPI) backup keys from an Active Directory domain controller through the MS-DRSR protocol. The output can be saved to the file system using the Save-DpapiBlob cmdlet. DPAPI is used by several components of Windows to securely store passwords, encryption keys and other sensitive data. When DPAPI is used in an Active Directory domain environment, a copy of the user's master key is encrypted with a so-called DPAPI Domain Backup Key that is known to all domain controllers. Windows Server 2000 DCs use a symmetric key and newer systems use a public/private key pair. If the user password is reset and the original master key is rendered inaccessible to the user, the user's access to the master key is automatically restored using the backup key. Get-ADReplBackupKey Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None Domain Specifies the DNS name of the target Active Directory domain. String String None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None Domain Specifies the DNS name of the target Active Directory domain. String String None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None None DSInternals.Common.Data.DPAPIBackupKey -------------------------- Example 1 -------------------------- PS C:\> Get-ADReplBackupKey -Server 'lon-dc1.contoso.com' <# Sample Output: FilePath : ntds_legacy_b116cbfa-b881-43e6-ba85-ef3efa64ba22.key KiwiCommand : Type : LegacyKey DistinguishedName : CN=BCKUPKEY_b116cbfa-b881-43e6-ba85-ef3efa64ba22 Secret,CN=System,DC=contoso,DC=com KeyId : b116cbfa-b881-43e6-ba85-ef3efa64ba22 Data : {1, 0, 0, 0...} FilePath : KiwiCommand : Type : PreferredLegacyKeyPointer DistinguishedName : CN=BCKUPKEY_P Secret,CN=System,DC=contoso,DC=com KeyId : b116cbfa-b881-43e6-ba85-ef3efa64ba22 Data : {250, 203, 22, 177...} FilePath : ntds_capi_290914ed-b1a8-482e-a89f-7caa217bf3c3.pvk KiwiCommand : REM Add this parameter to at least the first dpapi::masterkey command: /pvk:"ntds_capi_290914ed-b1a8-482e-a89f-7caa217bf3c3.pvk" Type : RSAKey DistinguishedName : CN=BCKUPKEY_290914ed-b1a8-482e-a89f-7caa217bf3c3 Secret,CN=System,DC=contoso,DC=com KeyId : 290914ed-b1a8-482e-a89f-7caa217bf3c3 Data : {2, 0, 0, 0...} FilePath : KiwiCommand : Type : PreferredRSAKeyPointer DistinguishedName : CN=BCKUPKEY_PREFERRED Secret,CN=System,DC=contoso,DC=com KeyId : 290914ed-b1a8-482e-a89f-7caa217bf3c3 Data : {237, 20, 9, 41...} #> Replicates all DPAPI backup keys from the target Active Directory domain controller. -------------------------- Example 2 -------------------------- PS C:\> Get-ADReplBackupKey -Server 'lon-dc1.adatum.com' | Save-DpapiBlob -DirectoryPath '.\Output' PS C:\> Get-ChildItem -Path '.\Output' | Select-Object -ExpandProperty Name <# Sample Output: kiwiscript.txt ntds_legacy_b116cbfa-b881-43e6-ba85-ef3efa64ba22.key ntds_capi_4cee80c0-b6c6-406c-a68b-c0e5818bc436.cer ntds_capi_290914ed-b1a8-482e-a89f-7caa217bf3c3.pfx ntds_capi_290914ed-b1a8-482e-a89f-7caa217bf3c3.pvk #> Replicates all DPAPI backup keys from the target Active Directory domain controller and saves them to the Output directory. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADReplBackupKey.md Save-DpapiBlob Get-ADDBBackupKey Get-LsaBackupKey Get-ADReplKdsRootKey Get ADReplKdsRootKey Fetches the specified KDS Root Key through the MS-DRSR protocol. KDS Root Keys are used to encrypt the following: - SID-protected private keys in PFX certificate files - BitLocker-enabled drives with SID protector - Passwords of Group Managed Service Accounts (gMSA) and Delegated Managed Service Accounts (dMSA) - DNSSEC key signing keys - Windows LAPS passwords Get-ADReplKdsRootKey RootKeyId Specifies a single KDS Root Key to be fetched. Guid Guid None Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None RootKeyId Specifies a single KDS Root Key to be fetched. Guid Guid None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None System.Guid DSInternals.Common.Data.KdsRootKey -------------------------- Example 1 -------------------------- PS C:\> Get-ADReplKdsRootKey -Server CONTOSO-DC -RootKeyId 1c556b71-ed22-c45f-723c-ddbe199f6824 <# Sample Output: Id: 1c556b71-ed22-c45f-723c-ddbe199f6824 Creation Time: 7/17/2025 10:13:54 AM Effective Time: 7/17/2025 12:13:54 AM Domain Controller: CN=CONTOSO-DC,OU=Domain Controllers,DC=contoso,DC=com Key: ccc82c5ed3c98fdb0c2890b2881c01e3a0dbc0f5594fca5b5aab7286fff60154b0733fab4b0ec5b622c1c2ab9c45cf1567893534f073ab6fb072e8113bbce329 Key Derivation Function Algorithm: SP800_108_CTR_HMAC Parameters: {[0, SHA512]} Secret Agreement Algorithm: DH Public Key Length: 2048 Private Key Length: 512 Parameters 0c0200004448504d0001000087a8e61db4b6663cffbbd19c651959998ceef608660dd0f25d2ceed4435e3b00e00df8f1d61957d4faf7df4561b2aa3016c3d91134096faa3 bf4296d830e9a7c209e0c6497517abd5a8a9d306bcf67ed91f9e6725b4758c022e0b1ef4275bf7b6c5bfc11d45f9088b941f54eb1e59bb8bc39a0bf12307f5c4fdb70c581 b23f76b63acae1caa6b7902d52526735488a0ef13c6d9a51bfa4ab3ad8347796524d8ef6a167b5a41825d967e144e5140564251ccacb83e6b486f6b3ca3f7971506026c0b 857f689962856ded4010abd0be621c3a3960a54e710c375f26375d7014103a4b54330c198af126116d2276e11715f693877fad7ef09cadb094ae91e1a15973fb32c9b7313 4d0b2e77506660edbd484ca7b18f21ef205407f4793a1a0ba12510dbc15077be463fff4fed4aac0bb555be3a6c1b0c6b47b1bc3773bf7e8c6f62901228f8c28cbb18a55ae 31341000a650196f931c77a57f2ddf463e5e9ec144b777de62aaab8a8628ac376d282d6ed3864e67982428ebc831d14348f6f2f9193b5045af2767164e1dfc967c1fb3f2e 55a4bd1bffe83b9c80d052b985d182ea0adb2a3b7313d3fe14c8484b1e052588b9b7d2bbd2df016199ecd06e1557cd0915b3353bbb64e0ec377fd028370df92b52c789142 8cdc67eb6184b523d1db246c32f63078490f00ef8d647d148d47954515e2327cfef98c582664b4c0f6cc41659 #> Retrieves the KDS Root Key with ID 1c556b71-ed22-c45f-723c-ddbe199f6824 from a DC using the replication protocol. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADReplKdsRootKey.md Get-ADDBKdsRootKey Get-ADSIKdsRootKey Get-ADSIAccount Get ADSIAccount Gets one or more Active Directory accounts from a given domain controller using ADSI. Typically used for Credential Roaming data retrieval through LDAP. Gets one or more Active Directory accounts from a given domain controller using ADSI/LDAP. Typically used for Credential Roaming data retrieval and NGC key auditing. A single account can be retrieved by specifying its `SamAccountName`, `UserPrincipalName`, `ObjectSid`, `DistinguishedName`, or `ObjectGuid`. When no identifier is supplied, all accounts in the target domain are returned. Get-ADSIAccount All Indicates that all accounts will be retrieved from the target domain controller. This is the default behavior when no identifier is specified. SwitchParameter False Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None KdsRootKey Provides an explicit set of KDS root keys to use when decrypting Windows LAPS passwords. When this parameter is specified, the supplied keys override the default LDAP-based lookup against the configuration naming context. KdsRootKey[] KdsRootKey[] None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Get-ADSIAccount DistinguishedName Specifies the distinguished name of the account that will be retrieved. String String None Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None KdsRootKey Provides an explicit set of KDS root keys to use when decrypting Windows LAPS passwords. When this parameter is specified, the supplied keys override the default LDAP-based lookup against the configuration naming context. KdsRootKey[] KdsRootKey[] None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Get-ADSIAccount Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None KdsRootKey Provides an explicit set of KDS root keys to use when decrypting Windows LAPS passwords. When this parameter is specified, the supplied keys override the default LDAP-based lookup against the configuration naming context. KdsRootKey[] KdsRootKey[] None ObjectGuid Specifies the object GUID of the account that will be retrieved. Guid Guid None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Get-ADSIAccount Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None KdsRootKey Provides an explicit set of KDS root keys to use when decrypting Windows LAPS passwords. When this parameter is specified, the supplied keys override the default LDAP-based lookup against the configuration naming context. KdsRootKey[] KdsRootKey[] None ObjectSid Specifies the security identifier (SID) of the account that will be retrieved. SecurityIdentifier SecurityIdentifier None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Get-ADSIAccount SamAccountName Specifies the sAMAccountName of the account that will be retrieved. String String None Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None KdsRootKey Provides an explicit set of KDS root keys to use when decrypting Windows LAPS passwords. When this parameter is specified, the supplied keys override the default LDAP-based lookup against the configuration naming context. KdsRootKey[] KdsRootKey[] None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Get-ADSIAccount Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None KdsRootKey Provides an explicit set of KDS root keys to use when decrypting Windows LAPS passwords. When this parameter is specified, the supplied keys override the default LDAP-based lookup against the configuration naming context. KdsRootKey[] KdsRootKey[] None Properties Specifies the set of properties that will be retrieved for each account. None DistinguishedName GenericAccountInfo GenericUserInfo GenericComputerInfo GenericInfo SecurityDescriptor NTHash LMHash PasswordHashes NTHashHistory LMHashHistory PasswordHashHistory SupplementalCredentials Secrets KeyCredentials RoamedCredentials WindowsLAPS LegacyLAPS LAPS ManagedBy Manager All AccountPropertySets AccountPropertySets All Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None UserPrincipalName Specifies the user principal name (UPN) of the account that will be retrieved. String String None All Indicates that all accounts will be retrieved from the target domain controller. This is the default behavior when no identifier is specified. SwitchParameter SwitchParameter False Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None DistinguishedName Specifies the distinguished name of the account that will be retrieved. String String None KdsRootKey Provides an explicit set of KDS root keys to use when decrypting Windows LAPS passwords. When this parameter is specified, the supplied keys override the default LDAP-based lookup against the configuration naming context. KdsRootKey[] KdsRootKey[] None ObjectGuid Specifies the object GUID of the account that will be retrieved. Guid Guid None ObjectSid Specifies the security identifier (SID) of the account that will be retrieved. SecurityIdentifier SecurityIdentifier None Properties Specifies the set of properties that will be retrieved for each account. AccountPropertySets AccountPropertySets All SamAccountName Specifies the sAMAccountName of the account that will be retrieved. String String None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None UserPrincipalName Specifies the user principal name (UPN) of the account that will be retrieved. String String None System.String System.Security.Principal.SecurityIdentifier System.Guid DSInternals.Common.Data.DSAccount DSInternals.Common.Data.DSUser DSInternals.Common.Data.DSComputer -------------------------- Example 1 -------------------------- PS C:\> Get-LsaBackupKey -ComputerName 'lon-dc1.contoso.com' | Save-DpapiBlob -DirectoryPath '.\Output' PS C:\> Get-ADSIAccount -Server 'lon-dc1.contoso.com' | Save-DpapiBlob -DirectoryPath '.\Output' Retrieves DPAPI backup keys from the target domain controller through the MS-LSAD protocol. Also retrieves roamed credentials (certificates, private keys, and DPAPI master keys) from this domain controller through LDAP and saves them to the Output directory. Also creates a file called kiwiscript.txt that contains mimikatz commands needed to decrypt the private keys. -------------------------- Example 2 -------------------------- PS C:\> Get-ADSIAccount -Server 'lon-dc1.contoso.com' | Select-Object -ExpandProperty KeyCredentials | Where-Object Usage -eq NGC | Format-Table -View ROCA <# Sample Output: Usage IsWeak Source DeviceId Created Owner ----- ------ ------ -------- ------- ----- NGC True AzureAD fd591087-245c-4ff5-a5ea-c14de5e2b32d 2017-07-19 CN=John Doe,CN=Users,DC=contoso,DC=com NGC False AD 1966d4da-14da-4581-a7a7-5e8e07e93ad9 2019-08-01 CN=Jane Doe,CN=Users,DC=contoso,DC=com #> Lists weak public keys registered in Active Directory that were generated on ROCA-vulnerable TPMs. -------------------------- Example 3 -------------------------- PS C:\> Get-ADSIAccount -Server 'lon-dc1.contoso.com' -SamAccountName 'joe' Retrieves a single Active Directory user account by its `sAMAccountName` through LDAP. -------------------------- Example 4 -------------------------- PS C:\> Get-ADSIAccount -Server 'lon-dc1.contoso.com' -UserPrincipalName 'joe@contoso.com' Retrieves a single Active Directory user account by its user principal name through LDAP. -------------------------- Example 5 -------------------------- PS C:\> Get-ADSIAccount -SamAccountName 'CONTOSO-DC$' <# Sample Output: DistinguishedName: CN=CONTOSO-DC,OU=Domain Controllers,DC=contoso,DC=com SamAccountName: CONTOSO-DC$ Enabled: True Deleted: False Sid: S-1-5-21-3288850392-3299536932-2614793081-1001 Guid: 21c7a90a-a253-4824-a06a-27ef04c8e25c SamAccountType: Computer UserAccountControl: ServerAccount, TrustedForDelegation DNSHostName: CONTOSO-DC.contoso.com OperatingSystem: Windows Server 2025 Standard OperatingSystemVersion: 10.0 (26100) Description: PrimaryGroupId: 516 SidHistory: SupportedEncryptionTypes: RC4_HMAC, AES128_CTS_HMAC_SHA1_96, AES256_CTS_HMAC_SHA1_96 ServicePrincipalName: {Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/CONTOSO-DC.contoso.com, ldap/CONTOSO-DC.contoso.com/ForestDnsZones.contoso.com, ldap/CONTOSO-DC.contoso.com/DomainDnsZones.contoso.com, TERMSRV/CONTOSO-DC...} LastLogonDate: 5/27/2026 10:50:25 AM PasswordLastSet: 5/8/2026 7:21:59 PM SecurityDescriptor: DiscretionaryAclPresent, SystemAclPresent, DiscretionaryAclAutoInherited, SystemAclAutoInherited, SelfRelative LAPS Password: StoodRaidBaker, Expires: 5/27/2026 2:42:55 PM Password: WagonPulpDebt, Expires: Password: EarthSmogTidy, Expires: Password: PropsSlawFox, Expires: Password: YummyPennyTrout, Expires: Password: CrampGladBadge, Expires: Password: HelpSalsaClean, Expires: Password: JulyFoeUntie, Expires: Password: GreenSushiSnub, Expires: Password: WagonCauseRadar, Expires: Password: PerchDarnOpt, Expires: Password: DodgeLunarDad, Expires: Password: ImageCorkSilo, Expires: Key Credentials Secrets NTHash: LMHash: NTHashHistory: LMHashHistory: SupplementalCredentials: #> Retrieves a single computer account (a domain controller) by its `sAMAccountName` through LDAP and displays its Windows LAPS password history. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADSIAccount.md Get-ADDBAccount Get-ADReplAccount Save-DpapiBlob Get-ADKeyCredential Get-ADSIDnsServerResourceRecord Get ADSIDnsServerResourceRecord Retrieves DNS resource records from Active Directory through LDAP. This cmdlet retrieves DNS resource records hosted in Active Directory by querying the target domain controller through LDAP. Both legacy DNS records stored under the domain naming context and modern records stored in application partitions (such as DomainDnsZones and ForestDnsZones) are returned. Tombstoned records and root hints are omitted by default and can be included with the corresponding switch parameters. Get-ADSIDnsServerResourceRecord Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None IncludeRootHints Indicates that root hints should be included in the output. SwitchParameter False IncludeTombstones Indicates that tombstoned DNS records should be included in the output. SwitchParameter False IncludeTrustAnchors Indicates that DNSSEC trust anchor records should be included in the output. SwitchParameter False Server Specifies the target domain controller. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None ZoneName Restricts the output to records belonging to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None IncludeRootHints Indicates that root hints should be included in the output. SwitchParameter SwitchParameter False IncludeTombstones Indicates that tombstoned DNS records should be included in the output. SwitchParameter SwitchParameter False IncludeTrustAnchors Indicates that DNSSEC trust anchor records should be included in the output. SwitchParameter SwitchParameter False Server Specifies the target domain controller. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None ZoneName Restricts the output to records belonging to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None System.String DSInternals.Common.DNS.DnsResourceRecord -------------------------- Example 1 -------------------------- PS C:\> Get-ADSIDnsServerResourceRecord -Server 'lon-dc1.contoso.com' | Where-Object Zone -eq 'contoso.com' | Where-Object Type -in SOA,NS,A,CNAME,MX | Sort-Object -Property Name Retrieves DNS resource records from the specified domain controller through LDAP and displays the SOA, NS, A, CNAME, and MX records from the contoso.com zone in a text format compatible with Windows Server and BIND zone files. -------------------------- Example 2 -------------------------- PS C:\> Get-ADSIDnsServerResourceRecord -Server 'lon-dc1.contoso.com' | Save-DnsServerResourceRecord -Path '.\Zones' -Verbose Retrieves all DNS resource records from the specified domain controller and saves them to DNS zone files in the Zones directory. -------------------------- Example 3 -------------------------- PS C:\> Get-ADSIDnsServerResourceRecord -ZoneName 'example.com' <# Sample Output: @ NS contoso-dc.contoso.com. @ NS ns1.example.com. @ IN SOA contoso-dc.contoso.com. hostmaster.contoso.com. ( 104 ; serial number 900 ; refresh 600 ; retry 86400 ; expire 3600 ) ; default TTL @ MX 10 mail.example.com. @ MX 20 backup.example.com. @ TXT ( "v=spf1 -all" ) @ 0 WINS LOCAL L2 C900 ( 192.0.2.100 ) _25._tcp.mail TLSA 0 0 2 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA _443._tcp.www TLSA 3 1 1 0000000000000000000000000000000000000000000000000000000000000000 _afs3-vlserver._udp SRV 0 100 7003 afs.example.com. _ldap._tcp SRV 0 100 389 dc01.example.com. afsdb-sample AFSDB 1 afs.example.com. afsdb-sample AFSDB 2 dce.example.com. alias CNAME www.example.com. atma-e164 ATMA +123456789 atma-e164 ATMA +1.2345.6789 dhcid-sample DHCID AAIBY2/AuCccgoJbsaxcQc9TUapptP69lOjxfNuVAA2kjEA= full6 AAAA 2001:db8::42 hinfo-arm HINFO ( "ARM64" "Linux" ) hinfo-sample HINFO ( "Intel-x64" "Windows" ) isdn-sample ISDN ( "150862028003217" "004" ) ptr-sample PTR target.example.com. quoted TXT ( "value with \"embedded quotes\" and spaces" ) rp-sample RP admin.example.com. admin-info.example.com. rt-sample RT 10 router.example.com. sub DNAME other.example.com. sub2 DNAME other.example.com. wks-tcp WKS 192.0.2.20 tcp ( smtp domain http ) wks-udp WKS 192.0.2.21 udp ( domain ntp snmp ) www A 192.0.2.10 www A 192.0.2.11 www6 AAAA 2001:db8::1 x25-sample X25 ( "311061700956" ) atma-nsap ATMA 47.0027.01000000000000000000.000000000000.00 #> Retrieves the resource records belonging to the example.com zone and renders them in the BIND and Windows Server compatible zone file text format. The sample illustrates how the supported record types (NS, SOA, MX, TXT, WINS, TLSA, SRV, AFSDB, CNAME, ATMA, DHCID, AAAA, HINFO, ISDN, PTR, RP, RT, DNAME, WKS, A, and X25) are presented. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADSIDnsServerResourceRecord.md Get-ADSIDnsServerZone Get-ADDBDnsServerResourceRecord Save-DnsServerResourceRecord Get-ADSIDnsServerSigningKey Get ADSIDnsServerSigningKey Retrieves DNSSEC signing key descriptors from Active Directory through LDAP. This cmdlet retrieves the DNSSEC zone signing key (ZSK) and key signing key (KSK) descriptors hosted in Active Directory by querying the target domain controller through LDAP. Only the key metadata is returned; use the Export-ADSIDnsServerSigningKey cmdlet to export the private key material. Get-ADSIDnsServerSigningKey Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None Server Specifies the target domain controller. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None ZoneName Restricts the output to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None Server Specifies the target domain controller. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None ZoneName Restricts the output to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None System.String DSInternals.Common.DNS.DnsSigningKeyDescriptor -------------------------- Example 1 -------------------------- PS C:\> Get-ADSIDnsServerSigningKey -Server 'lon-dc1.contoso.com' -ZoneName 'contoso.com' <# Sample Output: ZoneName : contoso.com KeyId : 2e8c3148-04b3-462d-ae45-d87fe631fcee KeyType : ZoneSigningKey CryptoAlgorithm : RsaSha256 KeyLength : 1024 CurrentState : Active ZoneSignatureValidityPeriod : 10.00:00:00 DnsKeySignatureValidityPeriod : 7.00:00:00 DSSignatureValidityPeriod : 7.00:00:00 IsRolloverEnabled : True RolloverType : PrePublish RolloverPeriod : 90.00:00:00 InitialRolloverOffset : 00:00:00 CurrentRolloverStatus : NotRolling NextRolloverAction : Normal LastRolloverTime : 3/28/2026 12:35:27 AM NextRolloverTime : 8/15/2026 9:21:46 AM NextKeyGenerationTime : 5/17/2026 9:21:46 AM KeyStorageProvider : Microsoft Software Key Storage Provider StoreKeysInAD : True ActiveKey : 1c3737ea-f9a4-4902-b6a1-debc6227e627 ActiveKeyScope : Default NextKey : 0b2ec560-1db7-41aa-98c6-8bdacc8727e5 NextKeyScope : AddOnly StandbyKey : StandbyKeyScope : Default ZoneName : contoso.com KeyId : e6eb8329-330c-4dd3-9989-2827434cb3d5 KeyType : KeySigningKey CryptoAlgorithm : EcDsaP256Sha256 KeyLength : 256 CurrentState : Active ZoneSignatureValidityPeriod : 10.00:00:00 DnsKeySignatureValidityPeriod : 7.00:00:00 DSSignatureValidityPeriod : 7.00:00:00 IsRolloverEnabled : True RolloverType : DoubleSignature RolloverPeriod : 755.00:00:00 InitialRolloverOffset : 00:00:00 CurrentRolloverStatus : NotRolling NextRolloverAction : Normal LastRolloverTime : NextRolloverTime : 6/10/2028 9:21:46 AM NextKeyGenerationTime : KeyStorageProvider : Microsoft Software Key Storage Provider StoreKeysInAD : True ActiveKey : f91d2384-895d-45a2-adf9-f037624a107f ActiveKeyScope : Default NextKey : NextKeyScope : Default StandbyKey : ddf94e7e-0ed8-4bbb-9447-03fe66202874 StandbyKeyScope : AddOnly #> Retrieves the DNSSEC signing key descriptors for the contoso.com zone from the specified domain controller through LDAP. The zone is protected by a zone signing key (ZSK) and a key signing key (KSK). -------------------------- Example 2 -------------------------- PS C:\> Get-ADSIDnsServerSigningKey -Server 'lon-dc1.contoso.com' | Format-Table <# Sample Output: ZoneName KeyType Algorithm KeyLength State RolloverType -------- ------- --------- --------- ----- ------------ contoso.com ZoneSigningKey RsaSha256 1024 Active PrePublish contoso.com KeySigningKey EcDsaP256Sha256 256 Active DoubleSignature #> Displays a condensed table of all DNSSEC signing keys from the specified domain controller. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADSIDnsServerSigningKey.md Export-ADSIDnsServerSigningKey Get-ADDBDnsServerSigningKey Get-ADSIDnsServerZone Get-ADSIDnsServerZone Get ADSIDnsServerZone Retrieves the list of DNS zones hosted in Active Directory through LDAP. This cmdlet retrieves DNS zones hosted in Active Directory by querying the target domain controller through LDAP. Both legacy DNS zones stored under the domain naming context and modern zones stored in application partitions (such as DomainDnsZones and ForestDnsZones) are returned. Pseudo-zones used for root hints and DNSSEC trust anchors are excluded from the results. Get-ADSIDnsServerZone Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None Server Specifies the target domain controller. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None ZoneName Restricts the output to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None Server Specifies the target domain controller. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None ZoneName Restricts the output to the DNS zone with the specified name. The value is matched case-insensitively against the zone's fully qualified domain name (FQDN). String String None System.String DSInternals.Common.DNS.DnsZone -------------------------- Example 1 -------------------------- PS C:\> Get-ADSIDnsServerZone -Server 'lon-dc1.contoso.com' <# Sample Output: DistinguishedName : DC=_msdcs.contoso.com,CN=MicrosoftDNS,DC=ForestDnsZones,DC=contoso,DC=com ZoneName : _msdcs.contoso.com IsDsIntegrated : True IsReverseLookupZone : False IsSigned : False SignWithNSEC3 : False NSEC3CurrentSalt : DistinguishedName : DC=contoso.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=contoso,DC=com ZoneName : contoso.com IsDsIntegrated : True IsReverseLookupZone : False IsSigned : True SignWithNSEC3 : False NSEC3CurrentSalt : 879006FFA707C0F7 DistinguishedName : DC=adatum.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=contoso,DC=com ZoneName : adatum.com IsDsIntegrated : True IsReverseLookupZone : False IsSigned : False SignWithNSEC3 : False NSEC3CurrentSalt : DistinguishedName : DC=example.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=contoso,DC=com ZoneName : example.com IsDsIntegrated : True IsReverseLookupZone : False IsSigned : False SignWithNSEC3 : False NSEC3CurrentSalt : #> Retrieves the list of DNS zones from the specified domain controller. -------------------------- Example 2 -------------------------- PS C:\> Get-ADSIDnsServerZone -Server 'lon-dc1.contoso.com' | Format-Table <# Sample Output: ZoneName IsSigned IsReverseLookupZone -------- -------- ------------------- _msdcs.contoso.com False False contoso.com True False adatum.com False False example.com False False #> Displays a condensed table of the DNS zones hosted on the specified domain controller. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADSIDnsServerZone.md Get-ADSIDnsServerResourceRecord Get-ADDBDnsServerZone Get-ADSIKdsRootKey Get ADSIKdsRootKey Reads KDS Root Keys from a domain controller through the LDAP protocol. KDS Root Keys are used to encrypt the following: - SID-protected private keys in PFX certificate files - BitLocker-enabled drives with SID protector - Passwords of Group Managed Service Accounts (gMSA) and Delegated Managed Service Accounts (dMSA) - DNSSEC key signing keys - Windows LAPS passwords KDS Root Keys are stored in the configuration partition of Active Directory. Their secret material can be retrieved by any user that is a member of the Domain Admins or Enterprise Admins group. Get-ADSIKdsRootKey All Indicates that all KDS Root Keys should be fetched. SwitchParameter False Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the parameter is omitted, the cmdlet connects to the current user's domain. String String None Get-ADSIKdsRootKey RootKeyId Specifies a single KDS Root Key to be fetched. Guid Guid None Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the parameter is omitted, the cmdlet connects to the current user's domain. String String None All Indicates that all KDS Root Keys should be fetched. SwitchParameter SwitchParameter False Credential Specifies a user account that has permission to perform this action. The default is the current user. PSCredential PSCredential None RootKeyId Specifies a single KDS Root Key to be fetched. Guid Guid None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the parameter is omitted, the cmdlet connects to the current user's domain. String String None System.Guid DSInternals.Common.Data.KdsRootKey -------------------------- Example 1 -------------------------- PS C:\> Get-ADSIKdsRootKey -Server CONTOSO-DC Retrieves all KDS Root Keys from the specified domain controller through LDAP. -------------------------- Example 2 -------------------------- PS C:\> Get-ADSIKdsRootKey -Server CONTOSO-DC -RootKeyId 1c556b71-ed22-c45f-723c-ddbe199f6824 <# Sample Output: Id: 1c556b71-ed22-c45f-723c-ddbe199f6824 Creation Time: 7/17/2025 10:13:54 AM Effective Time: 7/17/2025 12:13:54 AM Domain Controller: CN=CONTOSO-DC,OU=Domain Controllers,DC=contoso,DC=com Key: ccc82c5ed3c98fdb0c2890b2881c01e3a0dbc0f5594fca5b5aab7286fff60154b0733fab4b0ec5b622c1c2ab9c45cf1567893534f073ab6fb072e8113bbce329 Key Derivation Function Algorithm: SP800_108_CTR_HMAC Parameters: {[0, SHA512]} Secret Agreement Algorithm: DH Public Key Length: 2048 Private Key Length: 512 Parameters 0c0200004448504d0001000087a8e61db4b6663cffbbd19c651959998ceef608660dd0f25d2ceed4435e3b00e00df8f1d61957d4faf7df4561b2aa3016c3d91134096faa3bf4296d830e9a7c209e0c6497517abd5a8a9d306bcf67ed91f9e6725b4758c022e0b1ef4275bf7b6c5bfc11d45f9088b941f54eb1e59bb8bc39a0bf12307f5c4 fdb70c581b23f76b63acae1caa6b7902d52526735488a0ef13c6d9a51bfa4ab3ad8347796524d8ef6a167b5a41825d967e144e5140564251ccacb83e6b486f6b3ca3f7971506026c0b857f689962856ded4010abd0be621c3a3960a54e710c375f26375d7014103a4b54330c198af126116d2276e11715f693877fad7ef09cadb094ae91e 1a15973fb32c9b73134d0b2e77506660edbd484ca7b18f21ef205407f4793a1a0ba12510dbc15077be463fff4fed4aac0bb555be3a6c1b0c6b47b1bc3773bf7e8c6f62901228f8c28cbb18a55ae31341000a650196f931c77a57f2ddf463e5e9ec144b777de62aaab8a8628ac376d282d6ed3864e67982428ebc831d14348f6f2f9193b50 45af2767164e1dfc967c1fb3f2e55a4bd1bffe83b9c80d052b985d182ea0adb2a3b7313d3fe14c8484b1e052588b9b7d2bbd2df016199ecd06e1557cd0915b3353bbb64e0ec377fd028370df92b52c7891428cdc67eb6184b523d1db246c32f63078490f00ef8d647d148d47954515e2327cfef98c582664b4c0f6cc41659 #> Retrieves a single KDS Root Key by its identifier through LDAP and displays its secret key material, key derivation function, and secret agreement (Diffie-Hellman) parameters. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADSIKdsRootKey.md Get-ADDBKdsRootKey Get-ADReplKdsRootKey Get-ADSIServiceAccount Get ADSIServiceAccount Reads all Group Managed Service Accounts (gMSAs) and Delegated Managed Service Accounts (dMSAs) from a domain controller through LDAP, while deriving their current passwords from KDS root keys. Retrieves all Group Managed Service Accounts (gMSAs) and Delegated Managed Service Accounts (dMSAs) from the target domain controller using ADSI/LDAP. Managed passwords are derived from the available KDS root keys and the gMSA / dMSA password identifier metadata. By default, the interval ID stored in `msDS-ManagedPasswordId` is used as-is to derive the current managed password - no password-cycle math is performed. Supplying `-EffectiveTime` instead computes the password cycle for a given point in time (past or future). The KDS root keys are normally read from the configuration naming context of the target domain controller, which typically requires Enterprise Admin privileges. As an alternative, the keys can be supplied explicitly using the `-KdsRootKey` parameter, for instance when they have been retrieved through the MS-DRSR protocol or an offline ntds.dit file. Get-ADSIServiceAccount Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None EffectiveTime Specifies the date and time at which the generated credentials should be valid. When omitted, passwords are derived directly from the `msDS-ManagedPasswordId` and `msDS-ManagedPasswordPreviousId` attributes stored on each account, with no password-cycle math. DateTime DateTime None KdsRootKey Provides an explicit set of KDS root keys to use when deriving managed passwords. When this parameter is specified, the supplied keys override the default LDAP-based lookup against the configuration naming context. KdsRootKey[] KdsRootKey[] None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None Credential Specifies a user account to use when connecting to the target domain controller. The default is the current user. PSCredential PSCredential None EffectiveTime Specifies the date and time at which the generated credentials should be valid. When omitted, passwords are derived directly from the `msDS-ManagedPasswordId` and `msDS-ManagedPasswordPreviousId` attributes stored on each account, with no password-cycle math. DateTime DateTime None KdsRootKey Provides an explicit set of KDS root keys to use when deriving managed passwords. When this parameter is specified, the supplied keys override the default LDAP-based lookup against the configuration naming context. KdsRootKey[] KdsRootKey[] None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. String String None None DSInternals.Common.Data.GroupManagedServiceAccount -------------------------- Example 1 -------------------------- PS C:\> Get-ADSIServiceAccount -Server 'lon-dc1.contoso.com' <# Sample Output: DistinguishedName: CN=svc_adfs,CN=Managed Service Accounts,DC=contoso,DC=com Sid: S-1-5-21-2468531440-3719951020-3687476655-1109 Guid: 53c845f7-d9cd-471b-a364-e733641dcc86 SamAccountName: svc_adfs$ Description: ADFS Service Account Enabled: True Deleted: False UserAccountControl: WorkstationAccount SupportedEncryptionTypes: RC4_HMAC, AES128_CTS_HMAC_SHA1_96, AES256_CTS_HMAC_SHA1_96 ServicePrincipalName: {http/login.contoso.com, host/login.contoso.com} WhenCreated: 7/17/2025 8:13:54 AM PasswordLastSet: 4/13/2026 8:57:29 AM ManagedPasswordInterval: 30 ManagedPasswordId: RootKey=1c556b71-ed22-c45f-723c-ddbe199f6824, Cycle=4/13/2026 2:00:00 AM (L0=364, L1=1, L2=24) ManagedPasswordPreviousId: RootKey=1c556b71-ed22-c45f-723c-ddbe199f6824, Cycle=3/14/2026 1:00:00 AM (L0=363, L1=31, L2=16) KDS Derived Secrets (Calculated) EffectivePasswordId: RootKey=1c556b71-ed22-c45f-723c-ddbe199f6824, Cycle=4/13/2026 2:00:00 AM (L0=364, L1=1, L2=24) NTHash: ddb248366d7ae6cd553fd420b0ac4b6c Kerberos Keys AES256_CTS_HMAC_SHA1_96 Key: 05b9ce27af24b186786a29415505b134891bf2e80d2ea30dab378e8fb34111cf Iterations: 4096 AES128_CTS_HMAC_SHA1_96 Key: 3489a4a66a3b89bd4d36ab601b00cb79 Iterations: 4096 RC4_HMAC_NT Key: ddb248366d7ae6cd553fd420b0ac4b6c Iterations: 4096 #> Reads all Group Managed Service Accounts (gMSAs) and Delegated Managed Service Accounts (dMSAs) from the target domain controller, while deriving their current passwords from KDS root keys. -------------------------- Example 2 -------------------------- PS C:\> Get-ADSIServiceAccount -Server 'lon-dc1.contoso.com' -EffectiveTime (Get-Date).AddMonths(1) Reads all Group Managed Service Accounts (gMSAs) and Delegated Managed Service Accounts (dMSAs) from the target domain controller, while deriving their future passwords from KDS root keys. -------------------------- Example 3 -------------------------- PS C:\> $rootKeys = Get-ADDBKdsRootKey -DatabasePath 'C:\ADBackup\ntds.dit' PS C:\> Get-ADSIServiceAccount -Server 'lon-dc1.contoso.com' -KdsRootKey $rootKeys Reads KDS root keys from an offline ntds.dit file and then uses them to derive the managed passwords for all gMSAs and dMSAs on the target domain controller, bypassing the default LDAP-based lookup against the configuration naming context. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-ADSIServiceAccount.md Get-ADDBServiceAccount Get-ADSIAccount Get-ADSIKdsRootKey Get-BootKey Get BootKey Reads the Boot Key (AKA SysKey or System Key) from an online or offline SYSTEM registry hive. The BootKey/SysKey is an encryption key that is stored in the Windows SYSTEM registry hive. This key is used by several Windows components to encrypt sensitive information like the AD database, machine account password or system certificates etc. The Boot Key is returned in hexadecimal format. Get-BootKey Online Specifies that the action is to be taken on the operating system that is currently running on the local computer. SwitchParameter False Get-BootKey SystemHiveFilePath Path to an offline SYSTEM registry hive. String String None Online Specifies that the action is to be taken on the operating system that is currently running on the local computer. SwitchParameter SwitchParameter False SystemHiveFilePath Path to an offline SYSTEM registry hive. String String None None System.String -------------------------- Example 1 -------------------------- PS C:\> Get-BootKey -Online 0be7a2afe1713642182e9b96f73a75da Retrieves the BootKey from the currently running OS. -------------------------- Example 2 -------------------------- PS C:\> reg.exe SAVE HKLM\SYSTEM C:\RegBackup\SYSTEM.hiv PS C:\> $key = Get-BootKey -SystemHiveFilePath C:\RegBackup\SYSTEM.hiv Creates a backup of the SYSTEM registry hive and then retrieves the BootKey from this backup. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-BootKey.md Get-ADDBAccount Get-ADDBBackupKey Set-ADDBAccountPassword Set-ADDBAccountPasswordHash Set-ADDBBootKey Get-DpapiNgData Get DpapiNgData Parses DPAPI-NG protected data. This cmdlet parses a DPAPI-NG protected blob and returns a `CngProtectedDataBlob` object. The `Blob` parameter accepts either a byte array or a base64-encoded `CngProtectedDataBlob`. Get-DpapiNgData Blob Specifies the DPAPI-NG protected blob as a byte array or base64 string. Byte[] Byte[] None Blob Specifies the DPAPI-NG protected blob as a byte array or base64 string. Byte[] Byte[] None System.Byte[] DSInternals.Common.Cryptography.CngProtectedDataBlob Alias: `Get-CngDpapiData` -------------------------- Example 1 -------------------------- PS C:\> Get-DpapiNgData -Blob MIIBfgYJKoZIhvcNAQcDoIIBbzCCAWsCAQIxggEdooIBGQIBBDCB3ASBhAEAAABLRFNLAgAAAGwBAAAFAAAAAgAAAHFrVRwi7V/EcjzdvhmfaCQgAAAAGAAAABgAAADbXiCq9P/fSJ7/N+Pp/iN2B2WtpCgvzrvj0JscdeyQBGMAbwBuAHQAbwBzAG8ALgBjAG8AbQAAAGMAbwBuAHQAbwBzAG8ALgBjAG8AbQAAADBTBgkrBgEEAYI3SgEwRgYKKwYBBAGCN0oBATA4MDYwNAwDU0lEDC1TLTEtNS0yMS0zMjg4ODUwMzkyLTMyOTk1MzY5MzItMjYxNDc5MzA4MS01MTIwCwYJYIZIAWUDBAEtBCi/OCkpzyD9YKVGwFhAA7VGmfakng2fpmvMiG/DW4248BSlBDcfIFn+MEUGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMSAygtw55Qk5YcNtiAgEQgBiOh95J+ZwmKUL129c4D7lis40RYNLIs9g= <# Sample Output: Descriptor: SID=S-1-5-21-3288850392-3299536932-2614793081-512 ContentEncryptionAlgorithm: aes256gcm (2.16.840.1.101.3.4.1.46) SID/SDDL Protectors SID=S-1-5-21-3288850392-3299536932-2614793081-512 ProtectionKeyIdentifier: RootKey=1c556b71-ed22-c45f-723c-ddbe199f6824, Cycle=5/27/2026 6:00:00 AM (L0=364, L1=5, L2=2) KeyEncryptionAlgorithm: aes256wrap (2.16.840.1.101.3.4.1.45) #> Parses a base64-encoded blob produced by Protect-DpapiNgData (Protect-DpapiNgData.md)and displays its protection descriptor, content encryption algorithm, and the SID protector with its associated KDS protection key identifier. No decryption is performed. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-DpapiNgData.md Protect-DpapiNgData Unprotect-DpapiNgData Get-DpapiNgNamedDescriptor Get DpapiNgNamedDescriptor Gets one or more named DPAPI-NG protection descriptors. This cmdlet returns named DPAPI-NG protection descriptors from the current user's descriptor registry hive. When the `Name` parameter is supplied, the descriptor is resolved through the NCrypt DPAPI-NG API. Without `Name`, the cmdlet enumerates all descriptor registry values. When the `Machine` switch is supplied, the cmdlet queries or enumerates the local machine descriptor registry hive. The named descriptors are stored as `REG_SZ` registry values, where the value name is the descriptor display name and the value data is the protection descriptor rule string, under the following key: - Current user: `HKCU:\Software\Microsoft\Cryptography\NProtect\NamedDescriptors` - Local machine (`-Machine`): `HKLM:\Software\Microsoft\Cryptography\NProtect\NamedDescriptors` Get-DpapiNgNamedDescriptor Name Specifies the named descriptor display name. String String None Machine Indicates that descriptors should be queried from the local machine registry hive. SwitchParameter False Machine Indicates that descriptors should be queried from the local machine registry hive. SwitchParameter SwitchParameter False Name Specifies the named descriptor display name. String String None System.String System.Collections.Generic.KeyValuePair`2[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] Alias: `Get-CngDpapiNamedDescriptor` -------------------------- Example 1 -------------------------- PS C:\> Get-DpapiNgNamedDescriptor -Machine <# Sample Output: Key Value --- ----- OracleConnectionStringProtector SID=S-1-5-21-3288850392-3299536932-2614793081-1171 OR LOCAL=machine DomainAdmins SID=S-1-5-21-3288850392-3299536932-2614793081-512 #> Returns all named DPAPI-NG protection descriptors registered in the local machine hive. -------------------------- Example 2 -------------------------- PS C:\> Get-DpapiNgNamedDescriptor -Machine -Name OracleConnectionStringProtector <# Sample Output: Key Value --- ----- OracleConnectionStringProtector SID=S-1-5-21-3288850392-3299536932-2614793081-1171 OR LOCAL=machine #> Resolves a single named descriptor from the local machine hive by its name. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-DpapiNgNamedDescriptor.md New-DpapiNgNamedDescriptor Remove-DpapiNgNamedDescriptor Get-DpapiNgPfxCertificate Get DpapiNgPfxCertificate Extracts the SID-based DPAPI-NG certificate password protector from a PFX file. This cmdlet parses a PKCS #12 PFX file and returns the SID-protected certificate password metadata. The returned object contains the PFX file path and the DPAPI-NG encrypted certificate password protector. To decrypt the protected password, pipe the returned object to Unprotect-DpapiNgPfxCertificate (Unprotect-DpapiNgPfxCertificate.md#unprotect-dpapingpfxcertificate). Get-DpapiNgPfxCertificate Path Specifies the path to the PFX file. String String None Path Specifies the path to the PFX file. String String None System.String DSInternals.PowerShell.PfxProtectedPassword Alias: `Get-CngDpapiPfxCertificate` -------------------------- Example 1 -------------------------- PS C:\> Get-Item -Path C:\Certificates\*.pfx | Get-DpapiNgPfxCertificate <# Sample Output: FilePath: C:\Certificates\ContosoWildcard.pfx Password: EncryptedPassword Descriptor: SID=S-1-5-21-3288850392-3299536932-2614793081-519 OR SID=S-1-5-21-3288850392-3299536932-2614793081-512 ContentEncryptionAlgorithm: aes256gcm (2.16.840.1.101.3.4.1.46) SID/SDDL Protectors SID=S-1-5-21-3288850392-3299536932-2614793081-519 ProtectionKeyIdentifier: RootKey=1c556b71-ed22-c45f-723c-ddbe199f6824, Cycle=5/22/2026 6:00:00 AM (L0=364, L1=4, L2=22) KeyEncryptionAlgorithm: aes256wrap (2.16.840.1.101.3.4.1.45) SID=S-1-5-21-3288850392-3299536932-2614793081-512 ProtectionKeyIdentifier: RootKey=1c556b71-ed22-c45f-723c-ddbe199f6824, Cycle=5/22/2026 6:00:00 AM (L0=364, L1=4, L2=22) KeyEncryptionAlgorithm: aes256wrap (2.16.840.1.101.3.4.1.45) FilePath: C:\Certificates\ContosoWebServer.pfx Password: EncryptedPassword Descriptor: SID=S-1-5-21-3288850392-3299536932-2614793081-512 ContentEncryptionAlgorithm: aes256gcm (2.16.840.1.101.3.4.1.46) SID/SDDL Protectors SID=S-1-5-21-3288850392-3299536932-2614793081-512 ProtectionKeyIdentifier: RootKey=1c556b71-ed22-c45f-723c-ddbe199f6824, Cycle=5/22/2026 6:00:00 AM (L0=364, L1=4, L2=22) KeyEncryptionAlgorithm: aes256wrap (2.16.840.1.101.3.4.1.45) #> Enumerates all PFX files in the `C:\Certificates` directory and displays their SID-based protection metadata. The `Password` field is empty because the protected password has not been decrypted yet; pipe the result to Unprotect-DpapiNgPfxCertificate (Unprotect-DpapiNgPfxCertificate.md)to recover it. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-DpapiNgPfxCertificate.md Unprotect-DpapiNgPfxCertificate Get-ADDBKdsRootKey Get-ADReplKdsRootKey Get-ADSIKdsRootKey Get-DpapiNgSidKeyIdentifier Get DpapiNgSidKeyIdentifier Parses a SID-protected DPAPI-NG KeyId blob. This cmdlet parses a DPAPI-NG Protection Key Identifier (`KDSK`) blob and returns a `ProtectionKeyIdentifier` object. Such blobs are emitted by the Windows DPAPI-NG implementation when SID-based protectors are used and can be observed, for example, in the `KeyId` field of Microsoft-Windows-Crypto-NCrypt events. They identify the KDS root key and the L0/L1/L2 key cycle that was used to derive a group key. The `Blob` parameter accepts either a byte array or a hexadecimal string, matching the encoding used in the `KeyId` field of Microsoft-Windows-Crypto-NCrypt events. Get-DpapiNgSidKeyIdentifier Blob Specifies the DPAPI-NG Protection Key Identifier as a byte array or a hexadecimal string. Byte[] Byte[] None Blob Specifies the DPAPI-NG Protection Key Identifier as a byte array or a hexadecimal string. Byte[] Byte[] None System.Byte[] DSInternals.Common.Data.ProtectionKeyIdentifier Alias: `Get-CngDpapiSidKeyIdentifier` -------------------------- Example 1 -------------------------- PS C:\> Get-DpapiNgSidKeyIdentifier -Blob 010000004B44534B030000006C010000040000001C000000716B551C22ED5FC4723CDDBE199F6824080300001800000018000000444850420001000087A8E61DB4B6663CFFBBD19C651959998CEEF608660DD0F25D2CEED4435E3B00E00DF8F1D61957D4FAF7DF4561B2AA3016C3D91134096FAA3BF4296D830E9A7C209E0C6497517ABD5A8A9D306BCF67ED91F9E6725B4758C022E0B1EF4275BF7B6C5BFC11D45F9088B941F54EB1E59BB8BC39A0BF12307F5C4FDB70C581B23F76B63ACAE1CAA6B7902D52526735488A0EF13C6D9A51BFA4AB3AD8347796524D8EF6A167B5A41825D967E144E5140564251CCACB83E6B486F6B3CA3F7971506026C0B857F689962856DED4010ABD0BE621C3A3960A54E710C375F26375D7014103A4B54330C198AF126116D2276E11715F693877FAD7EF09CADB094AE91E1A15973FB32C9B73134D0B2E77506660EDBD484CA7B18F21EF205407F4793A1A0BA12510DBC15077BE463FFF4FED4AAC0BB555BE3A6C1B0C6B47B1BC3773BF7E8C6F62901228F8C28CBB18A55AE31341000A650196F931C77A57F2DDF463E5E9EC144B777DE62AAAB8A8628AC376D282D6ED3864E67982428EBC831D14348F6F2F9193B5045AF2767164E1DFC967C1FB3F2E55A4BD1BFFE83B9C80D052B985D182EA0ADB2A3B7313D3FE14C8484B1E052588B9B7D2BBD2DF016199ECD06E1557CD0915B3353BBB64E0EC377FD028370DF92B52C7891428CDC67EB6184B523D1DB246C32F63078490F00EF8D647D148D47954515E2327CFEF98C582664B4C0F6CC4165948FBF0376EBE9B8EAF89CCBBBB12B32F06C4EF6CDE6C927CA76CE8D110E922DFB6EF69C06DC5DD08641620224667CB8AB891CC36B38E32C720B60005BF742DE5A8F1287BD60C9A4CE091CA8873A3538951A268C7E3AA968C2281BAD68571DFEF17EC474BE8C7CD7D1BF251CC3A51270D18E8B3227E59DCC0FE6F45FCE66FE0838DF0E14B9DDF9F2621F39AEDE5A5E982E8CE4D74B64D046C22F7B40C825CACB41C73E1943E6B3F10BBF3CD9A659351C94658CEB54835D81F36734494A7EC768BA3C1478BB5FCACD60F415E61588925047C45A0B9E7CDB96DA3FE0199CBCF7FC89B5D503413AB31411F4769FFB47CCB498F5B89B947B01FF90A48AC12B5658EA163006F006E0074006F0073006F002E0063006F006D00000063006F006E0074006F0073006F002E0063006F006D000000 <# Sample Output: RootKeyId : 1c556b71-ed22-c45f-723c-ddbe199f6824 ForestName : contoso.com DomainName : contoso.com L0KeyId : 364 L1KeyId : 4 L2KeyId : 28 PublicKey : 444850420001000087a8e61db4b6663cffbbd19c651959998ceef608660dd0f25d2ceed4435e3b00e00df8f1d61957d4faf7df4561b2aa3016c3d91134096faa3bf4296d830e9a7c209e0c6497517abd5a8a9d306bcf67ed91f9e6725b4758c022e0b1ef4275bf7b6c5bfc11d45f9088b941f54eb1e59bb8bc39a0bf12307f5c 4fdb70c581b23f76b63acae1caa6b7902d52526735488a0ef13c6d9a51bfa4ab3ad8347796524d8ef6a167b5a41825d967e144e5140564251ccacb83e6b486f6b3ca3f7971506026c0b857f689962856ded4010abd0be621c3a3960a54e710c375f26375d7014103a4b54330c198af126116d2276e11715f693877fad7ef09ca db094ae91e1a15973fb32c9b73134d0b2e77506660edbd484ca7b18f21ef205407f4793a1a0ba12510dbc15077be463fff4fed4aac0bb555be3a6c1b0c6b47b1bc3773bf7e8c6f62901228f8c28cbb18a55ae31341000a650196f931c77a57f2ddf463e5e9ec144b777de62aaab8a8628ac376d282d6ed3864e67982428ebc83 1d14348f6f2f9193b5045af2767164e1dfc967c1fb3f2e55a4bd1bffe83b9c80d052b985d182ea0adb2a3b7313d3fe14c8484b1e052588b9b7d2bbd2df016199ecd06e1557cd0915b3353bbb64e0ec377fd028370df92b52c7891428cdc67eb6184b523d1db246c32f63078490f00ef8d647d148d47954515e2327cfef98c582 664b4c0f6cc4165948fbf0376ebe9b8eaf89ccbbbb12b32f06c4ef6cde6c927ca76ce8d110e922dfb6ef69c06dc5dd08641620224667cb8ab891cc36b38e32c720b60005bf742de5a8f1287bd60c9a4ce091ca8873a3538951a268c7e3aa968c2281bad68571dfef17ec474be8c7cd7d1bf251cc3a51270d18e8b3227e59dcc0 fe6f45fce66fe0838df0e14b9ddf9f2621f39aede5a5e982e8ce4d74b64d046c22f7b40c825cacb41c73e1943e6b3f10bbf3cd9a659351c94658ceb54835d81f36734494a7ec768ba3c1478bb5fcacd60f415e61588925047c45a0b9e7cdb96da3fe0199cbcf7fc89b5d503413ab31411f4769ffb47ccb498f5b89b947b01ff9 0a48ac12b5658ea1 Flags : PublicAsymmetricKey, SymmetricKey #> Parses an asymmetric (Diffie-Hellman) `KDSK` Protection Key Identifier. The `PublicAsymmetricKey` flag indicates that the envelope carries a group public key (the embedded `PublicKey`), and `SymmetricKey` indicates that the derived key may be used for both encryption and decryption. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-DpapiNgSidKeyIdentifier.md Get-DpapiNgData Get-ADDBKdsRootKey Get-ADReplKdsRootKey Get-ADSIKdsRootKey Get-LsaBackupKey Get LsaBackupKey Reads the DPAPI backup keys from a domain controller through the LSARPC protocol. Reads the Data Protection API (DPAPI) backup keys from an Active Directory domain controller through the MS-LSAD (AKA LSARPC) protocol. The output can be saved to the file system using the Save-DpapiBlob cmdlet. DPAPI is used by several components of Windows to securely store passwords, encryption keys and other sensitive data. When DPAPI is used in an Active Directory domain environment, a copy of the user's master key is encrypted with a so-called DPAPI Domain Backup Key that is known to all domain controllers. Windows Server 2000 DCs use a symmetric key and newer systems use a public/private key pair. If the user password is reset and the original master key is rendered inaccessible to the user, the user's access to the master key is automatically restored using the backup key. Get-LsaBackupKey ComputerName Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. The default is the local computer. To specify the local computer, such as in a list of computer names, use "localhost", the local computer name, or a dot (.). String String None ComputerName Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. The default is the local computer. To specify the local computer, such as in a list of computer names, use "localhost", the local computer name, or a dot (.). String String None None DSInternals.Common.Data.DPAPIBackupKey Administrative permissions on the target domain controller (DC) are required in order to retrieve DPAPI backup keys. -------------------------- Example 1 -------------------------- PS C:\> Get-LsaBackupKey -ComputerName LON-DC1 <# Sample Output: FilePath : ntds_capi_b1c56a3e-ddf7-41dd-a5f3-44a2ed27a96d.pvk KiwiCommand : REM Add this parameter to at least the first dpapi::masterkey command: /pvk:"ntds_capi_b1c56a3e-ddf7-41dd-a5f3-44a2ed27a96d.pvk" Type : RSAKey DistinguishedName : KeyId : b1c56a3e-ddf7-41dd-a5f3-44a2ed27a96d Data : {2, 0, 0, 0...} FilePath : ntds_legacy_7882b20e-96ef-4ce5-a2b9-3efdccbbce28.key KiwiCommand : Type : LegacyKey DistinguishedName : KeyId : 7882b20e-96ef-4ce5-a2b9-3efdccbbce28 Data : {1, 0, 0, 0...} #> Displays the DPAPI domain backup keys. -------------------------- Example 2 -------------------------- PS C:\> Get-LsaBackupKey -ComputerName LON-DC1 | Save-DpapiBlob -DirectoryPath '.\Output' PS C:\> Get-ChildItem -Path '.\Output' | Select-Object -ExpandProperty Name <# Sample Output: kiwiscript.txt ntds_legacy_b116cbfa-b881-43e6-ba85-ef3efa64ba22.key ntds_capi_4cee80c0-b6c6-406c-a68b-c0e5818bc436.cer ntds_capi_290914ed-b1a8-482e-a89f-7caa217bf3c3.pfx ntds_capi_290914ed-b1a8-482e-a89f-7caa217bf3c3.pvk #> Saves the DPAPI domain backup keys to the Output directory. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-LsaBackupKey.md Save-DpapiBlob Get-ADDBBackupKey Get-ADReplBackupKey Get-LsaPolicyInformation Get LsaPolicyInformation Retrieves AD-related information from the Local Security Authority Policy of the local computer or a remote one. The Local Security Authority (LSA) is a protected subsystem of Windows that maintains information about all aspects of local security on a system, collectively known as the local security policy of the system. The local security policy of a system is a set of information about the security of a local computer. Get-LsaPolicyInformation ComputerName Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. The default is the local computer. To specify the local computer, such as in a list of computer names, use "localhost", the local computer name, or a dot (.). String String None ComputerName Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. The default is the local computer. To specify the local computer, such as in a list of computer names, use "localhost", the local computer name, or a dot (.). String String None None DSInternals.PowerShell.LsaPolicyInformation -------------------------- Example 1 -------------------------- PS C:\> Get-LSAPolicyInformation <# Sample Output: Domain/Workgroup Name : WORKGROUP Account Domain Name : MYPC Account Domain SID : S-1-5-21-2814909047-1086830290-2660982408 Local Domain Name : MYPC Local Domain SID : S-1-5-21-2814909047-1086830290-2660982408 #> Retrieves LSA Policy from the local computer. -------------------------- Example 2 -------------------------- PS C:\> Get-LSAPolicyInformation -ComputerName LON-DC1 <# Sample Output: Domain/Workgroup Name : ADATUM Forest DNS Name : Adatum.com Domain DNS Name : Adatum.com Domain GUID : 281582b4-9d3e-449d-a238-676bd5844f56 Domain SID : S-1-5-21-3180365339-800773672-3767752645 Account Domain Name : ADATUM Account Domain SID : S-1-5-21-3180365339-800773672-3767752645 Local Domain Name : LON-DC1 Local Domain SID : S-1-5-21-2929860833-2984454239-2848460202 #> Retrieves LSA Policy from a remote computer called LON-DC1. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-LsaPolicyInformation.md Set-LsaPolicyInformation Get-LsaBackupKey LSA Policy https://docs.microsoft.com/en-us/windows/desktop/secmgmt/lsa-policy Get-SamPasswordPolicy Get SamPasswordPolicy Queries Active Directory for the default password policy. Retrieves the current password policy for a domain through the MS-SAMR protocol. Get-SamPasswordPolicy Credential Specifies the user account credentials to use to perform this task. The default credentials are the credentials of the currently logged on user. PSCredential PSCredential None Domain Specifies the NetBIOS domain name. Local accounts are stored a domain called Builtin. String String None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. The default is the local computer. To specify the local computer, such as in a list of computer names, use "localhost", the local computer name, or a dot (.). String String localhost UseNamedPipe Use named pipes (RPC/NP) transport instead of TCP to connect to the target server. SwitchParameter False Credential Specifies the user account credentials to use to perform this task. The default credentials are the credentials of the currently logged on user. PSCredential PSCredential None Domain Specifies the NetBIOS domain name. Local accounts are stored a domain called Builtin. String String None Server Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. The default is the local computer. To specify the local computer, such as in a list of computer names, use "localhost", the local computer name, or a dot (.). String String localhost UseNamedPipe Use named pipes (RPC/NP) transport instead of TCP to connect to the target server. SwitchParameter SwitchParameter False None DSInternals.SAM.SamDomainPasswordInformation -------------------------- Example 1 -------------------------- PS C:\> Get-SamPasswordPolicy -Domain CONTOSO -Server LON-DC1 <# Sample Output: MinPasswordLength : 8 ComplexityEnabled : True ReversibleEncryptionEnabled : False MaxPasswordAge : 90.00:00:00.0 MinPasswordAge : 01:00:00 PasswordHistoryCount : 10 #> Queries the LON-DC1 domain controller for default domain password policy. -------------------------- Example 2 -------------------------- PS C:\> Get-SamPasswordPolicy -Domain Builtin <# Sample Output: MinPasswordLength : 0 ComplexityEnabled : False ReversibleEncryptionEnabled : False MaxPasswordAge : 42.22:47:31.7437440 MinPasswordAge : 00:00:00 PasswordHistoryCount : 0 #> Queries the local computer for its current password policy. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Get-SamPasswordPolicy.md Set-SamAccountPasswordHash New-ADDBRestoreFromMediaScript New ADDBRestoreFromMediaScript Generates a PowerShell script that can be used to restore a domain controller from an IFM-equivalent backup (i.e. ntds.dit + SYSVOL). The New-ADDBRestoreFromMediaScript cmdlet was created to save the day under certain specific circumstances. Imagine a company that had been attacked by some ransomware to the extent that all their domain controllers have been wiped. Moreover, no proper System State backups of DCs are available, only file-level ones. As a consequence, they are not able to restore Active Directory, the time is ticking and their only option seems to be reinstalling the entire AD forest from scratch. It might be hard to believe that someone would have violated all the best practices and neglected planning for disaster recovery, but, alas, such situations have occurred in large enterprises during the 2017 NotPetya outbreak. I have therefore come up with a domain controller recovery method that I call Restore from Media (RFM). As already hinted, this method can be used to restore domain controllers from file-level backups. Unlike the Install from Media (IFM) (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816722(v=ws.10)) method, the Restore from Media method does not require network connectivity to a live writable domain controller. Nevertheless, the same installation source ([IFM backup](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816574(v=ws.10)) with SYSVOL)can be used with both methods of DC installation. To perform the Restore from Media operation, you need to have the following: - A full Install from Media (IFM) backup of a domain controller or equivalent file-level backup. The backup must contain these files: - Domain database file (ntds.dit) - SYSTEM registry hive or a corresponding Boot Key / SysKey - SYSVOL directory - A freshly installed Windows Server of the same version as the domain controller originally running the database that is to be restored. This information can be retrieved from the corresponding ntds.dit file using the Get-ADDBDomainController (Get-ADDBDomainController.md)cmdlet. - An isolated VLAN / virtual network as connectivity to any existing production domain controllers would have unforseen consequences. Follow these steps on the target server in order to restore the domain controller: 1. In case of Windows Server 2008 (R2), run the `$PSVersionTable.PSVersion` to verify that at least PowerShell 3 is installed. Upgrade (https://docs.microsoft.com/en-us/powershell/wmf/overview)if necessary. 2. Verify that the PowerShell Script Execution Policy (https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-6)is set to RemoteSigned, Unrestricted or Bypass in the LocalMachine scope. 3. Install (https://github.com/MichaelGrafnetter/DSInternals/wiki/Installation)the DSInternals PowerShell module for all users. 4. Copy the backup data to a local drive, e.g. C:\Backup. 5. Run the `New-ADDBRestoreFromMediaScript -DatabasePath 'C:\Backup\Active Directory\ntds.dit' > C:\Backup\Restore-ADDomainController.ps1` command. 6. Review the freshly generated PowerShell script and execute it. 7. Sit back and watch the magic happen. Up to 3 reboots will follow and the entire process may take up to 20 minutes to finish. You should then end up with a fully functional domain controller. The script that is generated by the `New-ADDBRestoreFromMediaScript` cmdlet does the following actions: - Rename the server to match the original domain controller. - Install a new forest by promoting the server to a domain controller. - Replace the newly generated database file (ntds.dit) and SYSVOL directory by the original ones. - Re-encrypt the database using the local Boot Key. - Update the LSA Policy to match the SID and GUID of the domain that is being restored. - Reset the Invocation ID of the domain controller. - Reconfigure SYSVOL replication in case it has been restored to a different path. A sample PowerShell script generated by the New-ADDBRestoreFromMediaScript cmdlet is in the New-ADDBRestoreFromMediaScript.Sample.ps1 file. New-ADDBRestoreFromMediaScript BootKey Specifies the system key that encrypts secrets stored in the database specified by the -DatabasePath parameter. If none is specified, it is automatically extracted from a backup of the SYSTEM registry hive, provided that it is present in the ..\registry\SYSTEM path relative to the -DatabasePath parameter. Byte[] Byte[] None DatabasePath Specifies a non-UNC path to the backup of domain database (ntds.dit file) that will be used to restore the domain controller. String String None LogPath Specifies a non-UNC path to a directory that contains the backup of domain log files. If not specified, the value of the DatabasePath parameter is used. String String None PostInstallScriptPath Specifies the path to an optional post-installation script that will be executed after the restore process is complete. String String None SafeModeAdministratorPassword Supplies the password for the administrator account when the computer is started in Safe Mode or a variant of Safe Mode, such as Directory Services Restore Mode. If no value is specified for this parameter, the cmdlet prompts you to enter and confirm a masked password. If specified with a value, the value must be a secure string. SecureString SecureString None SkipDNSServer Prevents the DNS Server role to be installed on the restored domain controller. SwitchParameter False StatusReportScriptPath Specifies the path to an optional script that will be executed before each phase of the restore process. String String None SysvolPath Specifies a non-UNC path to a directory that contains the backup of Sysvol data. If none is specified, the ..\SYSVOL\ path relative to the -DatabasePath parameter is used. String String None BootKey Specifies the system key that encrypts secrets stored in the database specified by the -DatabasePath parameter. If none is specified, it is automatically extracted from a backup of the SYSTEM registry hive, provided that it is present in the ..\registry\SYSTEM path relative to the -DatabasePath parameter. Byte[] Byte[] None DatabasePath Specifies a non-UNC path to the backup of domain database (ntds.dit file) that will be used to restore the domain controller. String String None LogPath Specifies a non-UNC path to a directory that contains the backup of domain log files. If not specified, the value of the DatabasePath parameter is used. String String None PostInstallScriptPath Specifies the path to an optional post-installation script that will be executed after the restore process is complete. String String None SafeModeAdministratorPassword Supplies the password for the administrator account when the computer is started in Safe Mode or a variant of Safe Mode, such as Directory Services Restore Mode. If no value is specified for this parameter, the cmdlet prompts you to enter and confirm a masked password. If specified with a value, the value must be a secure string. SecureString SecureString None SkipDNSServer Prevents the DNS Server role to be installed on the restored domain controller. SwitchParameter SwitchParameter False StatusReportScriptPath Specifies the path to an optional script that will be executed before each phase of the restore process. String String None SysvolPath Specifies a non-UNC path to a directory that contains the backup of Sysvol data. If none is specified, the ..\SYSVOL\ path relative to the -DatabasePath parameter is used. String String None None System.String This recovery procedure is NOT SUPPORTED by Microsoft. Use at your own risk in situations when Active Directory forest reinstallation is the only other option. -------------------------- Example 1 -------------------------- PS C:\> New-ADDBRestoreFromMediaScript -DatabasePath 'C:\IFM\Active Directory\ntds.dit' > C:\IFM\Restore.ps1 Generates a domain controller restoration script from a previously created IFM backup. The script can then be reviewed, modified if necessary, and executed manually. -------------------------- Example 2 -------------------------- PS C:\> New-ADDBRestoreFromMediaScript -DatabasePath 'C:\IFM\Active Directory\ntds.dit' -BootKey 610bc29e6f62ca7004e9872cd51a0116 -SysvolPath 'C:\IFM\SYSVOL' > C:\IFM\Restore.ps1 Same as the previous example, but with explicitly provided SYSVOL directory path and boot key. -------------------------- Example 3 -------------------------- ntdsutil.exe "activate instance ntds" ifm "create sysvol full C:\IFM" quit quit icacls.exe C:\Windows\Sysvol\domain\Policies\* /save C:\IFM\SYSVOL\PolicyPermissions.txt Creates an Install From Media (IFM) backup of a running domain controller and exports Group Policy ACLs. This backup can later be used by the New-ADDBRestoreFromMediaScript cmdlet. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/New-ADDBRestoreFromMediaScript.md Get-BootKey Get-ADDBDomainController New-DpapiNgNamedDescriptor New DpapiNgNamedDescriptor Registers a named DPAPI-NG protection descriptor. This cmdlet registers or updates a named DPAPI-NG protection descriptor in the current user's descriptor registry hive. When the `Machine` switch is supplied, the descriptor is registered in the local machine descriptor registry hive and can be queried with the DPAPI-NG machine key flag. The named descriptors are stored as `REG_SZ` registry values, where the value name is the descriptor display name and the value data is the protection descriptor rule string, under the following key: - Current user: `HKCU:\Software\Microsoft\Cryptography\NProtect\NamedDescriptors` - Local machine (`-Machine`): `HKLM:\Software\Microsoft\Cryptography\NProtect\NamedDescriptors` New-DpapiNgNamedDescriptor Name Specifies the named descriptor display name. String String None Descriptor Specifies the DPAPI-NG protection descriptor rule string. String String None Machine Indicates that the descriptor should be registered in the local machine registry hive. SwitchParameter False Descriptor Specifies the DPAPI-NG protection descriptor rule string. String String None Machine Indicates that the descriptor should be registered in the local machine registry hive. SwitchParameter SwitchParameter False Name Specifies the named descriptor display name. String String None System.String None Alias: `New-CngDpapiNamedDescriptor` -------------------------- Example 1 -------------------------- PS C:\> New-DpapiNgNamedDescriptor -Name 'LocalUser' -Descriptor 'LOCAL=user' Registers a named descriptor for the current user. -------------------------- Example 2 -------------------------- PS C:\> New-DpapiNgNamedDescriptor -Name 'LocalMachine' -Descriptor 'LOCAL=machine' -Machine Registers a named descriptor in the local machine hive. -------------------------- Example 3 -------------------------- PS C:\> New-DpapiNgNamedDescriptor -Name 'OracleConnectionStringProtector' -Descriptor 'SID=S-1-5-21-3288850392-3299536932-2614793081-1171 OR LOCAL=machine' -Machine Registers a SID-based named descriptor in the local machine hive that allows decryption by a specific account SID or by the local machine. The cmdlet produces no output; use Get-DpapiNgNamedDescriptor (Get-DpapiNgNamedDescriptor.md)with the `-Machine` switch to list the registered descriptors. -------------------------- Example 4 -------------------------- PS C:\> New-DpapiNgNamedDescriptor -Name 'DomainAdmins' -Descriptor 'SID=S-1-5-21-3288850392-3299536932-2614793081-512' -Machine Registers a SID-based named descriptor in the local machine hive that restricts decryption to members of the Domain Admins group. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/New-DpapiNgNamedDescriptor.md Get-DpapiNgNamedDescriptor Remove-DpapiNgNamedDescriptor Protect-DpapiNgData Protect DpapiNgData Encrypts text with DPAPI-NG. This cmdlet protects the supplied plaintext with DPAPI-NG and returns the protected binary blob as a base64 string. Use `Descriptor` to supply a protection descriptor rule string directly, or `NamedDescriptor` to use a registered named descriptor. When `NamedDescriptor` is used, the `Machine` switch resolves the descriptor in the local machine descriptor registry hive. The cleartext is encoded as UTF-16 little-endian before encryption by default. Supply `Encoding` to use a different text encoding. Protect-DpapiNgData Descriptor Specifies the DPAPI-NG protection descriptor rule string. String String None Cleartext Specifies the text to protect. String String None Encoding Specifies the text encoding used to convert `Cleartext` to bytes before encryption. Accepts a `System.Text.Encoding` instance (such as `[System.Text.Encoding]::UTF8`) or one of the following well-known encoding names, which are also offered through tab completion: `ASCII`, `BigEndianUnicode`, `Unicode`, `UTF32`, `UTF7`, `UTF8`. Encoding Encoding [System.Text.Encoding]::Unicode Protect-DpapiNgData NamedDescriptor Specifies the name of a registered DPAPI-NG protection descriptor. String String None Cleartext Specifies the text to protect. String String None Encoding Specifies the text encoding used to convert `Cleartext` to bytes before encryption. Accepts a `System.Text.Encoding` instance (such as `[System.Text.Encoding]::UTF8`) or one of the following well-known encoding names, which are also offered through tab completion: `ASCII`, `BigEndianUnicode`, `Unicode`, `UTF32`, `UTF7`, `UTF8`. Encoding Encoding [System.Text.Encoding]::Unicode Machine Indicates that the named descriptor should be resolved from the local machine registry hive. SwitchParameter False Cleartext Specifies the text to protect. String String None Descriptor Specifies the DPAPI-NG protection descriptor rule string. String String None Encoding Specifies the text encoding used to convert `Cleartext` to bytes before encryption. Accepts a `System.Text.Encoding` instance (such as `[System.Text.Encoding]::UTF8`) or one of the following well-known encoding names, which are also offered through tab completion: `ASCII`, `BigEndianUnicode`, `Unicode`, `UTF32`, `UTF7`, `UTF8`. Encoding Encoding [System.Text.Encoding]::Unicode Machine Indicates that the named descriptor should be resolved from the local machine registry hive. SwitchParameter SwitchParameter False NamedDescriptor Specifies the name of a registered DPAPI-NG protection descriptor. String String None System.String System.String Alias: `Protect-CngDpapiData` -------------------------- Example 1 -------------------------- PS C:\> Protect-DpapiNgData -Descriptor 'LOCAL=user' -Cleartext 'Pa$$w0rd' Protects text for the current user and returns a base64-encoded DPAPI-NG blob. -------------------------- Example 2 -------------------------- PS C:\> Protect-DpapiNgData -NamedDescriptor 'LocalMachine' -Machine -Cleartext 'Pa$$w0rd' Protects text by using a named descriptor registered in the local machine hive. -------------------------- Example 3 -------------------------- PS C:\> Protect-DpapiNgData -Descriptor 'SID=S-1-5-21-3288850392-3299536932-2614793081-512' -Cleartext 'Pa$$w0rd' -Encoding UTF8 <# Sample Output: MIIBfgYJKoZIhvcNAQcDoIIBbzCCAWsCAQIxggEdooIBGQIBBDCB3ASBhAEAAABLRFNLAgAAAGwBAAAFAAAAAgAAAHFrVRwi7V/EcjzdvhmfaCQgAAAAGAAAABgAAADbXiCq9P/fSJ7/N+Pp/iN2B2WtpCgvzrvj0JscdeyQBGMAbwBuAHQAbwBzAG8ALgBjAG8AbQAAAGMAbwBuAHQAbwBzAG8ALgBjAG8AbQAAADBTBgkrBgEEAYI3SgEwRgYKKwYBBAGCN0oBATA4MDYwNAwDU0lEDC1TLTEtNS0yMS0zMjg4ODUwMzkyLTMyOTk1MzY5MzItMjYxNDc5MzA4MS01MTIwCwYJYIZIAWUDBAEtBCi/OCkpzyD9YKVGwFhAA7VGmfakng2fpmvMiG/DW4248BSlBDcfIFn+MEUGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMSAygtw55Qk5YcNtiAgEQgBiOh95J+ZwmKUL129c4D7lis40RYNLIs9g= #> Encrypts the UTF-8 encoded text so that only a holder of the specified SID-bound group key (here, the Domain Admins group) can decrypt it, and returns the protected blob as a base64 string. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Protect-DpapiNgData.md Get-DpapiNgData Unprotect-DpapiNgData New-DpapiNgNamedDescriptor Remove-ADDBObject Remove ADDBObject Physically removes the specified object from a ntds.dit file, making it semantically inconsistent. Highly experimental! Physically removes the specified object from an offline Active Directory database (ntds.dit) file. This operation bypasses normal Active Directory deletion mechanisms and directly removes the object from the ESE database, which makes the database semantically inconsistent. This cmdlet is highly experimental and should only be used in lab environments or extreme disaster recovery scenarios. Remove-ADDBObject DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an object on which to perform this operation. String String None Force Forces the cmdlet to remove the specified object from the target database. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None Confirm Prompts you for confirmation before running the cmdlet. SwitchParameter False WhatIf Shows what would happen if the cmdlet runs. The cmdlet is not run. SwitchParameter False Remove-ADDBObject DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to remove the specified object from the target database. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an object on which to perform this operation. Guid Guid None Confirm Prompts you for confirmation before running the cmdlet. SwitchParameter False WhatIf Shows what would happen if the cmdlet runs. The cmdlet is not run. SwitchParameter False DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an object on which to perform this operation. String String None Force Forces the cmdlet to remove the specified object from the target database. SwitchParameter SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an object on which to perform this operation. Guid Guid None Confirm Prompts you for confirmation before running the cmdlet. SwitchParameter SwitchParameter False WhatIf Shows what would happen if the cmdlet runs. The cmdlet is not run. SwitchParameter SwitchParameter False System.String System.Guid None -------------------------- Example 1 -------------------------- PS C:\> Remove-ADDBObject -DistinguishedName 'CN=intruder,CN=Users,DC=contoso,DC=com' -DatabasePath '.\ntds.dit' Physically removes the object with the specified distinguished name from the offline ntds.dit file. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Remove-ADDBObject.md Remove-DpapiNgNamedDescriptor Remove DpapiNgNamedDescriptor Removes a named DPAPI-NG protection descriptor. This cmdlet removes a named DPAPI-NG protection descriptor from the current user's descriptor registry hive. When the `Machine` switch is supplied, the descriptor is removed from the local machine descriptor registry hive. The named descriptors are stored as `REG_SZ` registry values, where the value name is the descriptor display name and the value data is the protection descriptor rule string, under the following key: - Current user: `HKCU:\Software\Microsoft\Cryptography\NProtect\NamedDescriptors` - Local machine (`-Machine`): `HKLM:\Software\Microsoft\Cryptography\NProtect\NamedDescriptors` Remove-DpapiNgNamedDescriptor Name Specifies the named descriptor display name. String String None Machine Indicates that the descriptor should be removed from the local machine registry hive. SwitchParameter False Confirm Prompts you for confirmation before running the cmdlet. SwitchParameter False WhatIf Shows what would happen if the cmdlet runs. The cmdlet is not run. SwitchParameter False Machine Indicates that the descriptor should be removed from the local machine registry hive. SwitchParameter SwitchParameter False Name Specifies the named descriptor display name. String String None Confirm Prompts you for confirmation before running the cmdlet. SwitchParameter SwitchParameter False WhatIf Shows what would happen if the cmdlet runs. The cmdlet is not run. SwitchParameter SwitchParameter False System.String None Alias: `Remove-CngDpapiNamedDescriptor` -------------------------- Example 1 -------------------------- PS C:\> Remove-DpapiNgNamedDescriptor -Name 'LocalUser' Removes a named descriptor from the current user's descriptor hive. -------------------------- Example 2 -------------------------- PS C:\> Remove-DpapiNgNamedDescriptor -Name 'LocalMachine' -Machine Removes a named descriptor from the local machine descriptor hive. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Remove-DpapiNgNamedDescriptor.md New-DpapiNgNamedDescriptor Get-DpapiNgNamedDescriptor Save-DnsServerResourceRecord Save DnsServerResourceRecord Saves DNS resource records retrieved from Active Directory to one or more DNS zone files. Saves DNS resource records retrieved from Active Directory to DNS zone files. The cmdlet creates one `.dns` file for each DNS zone in the target directory. Existing zone files are not overwritten unless the Force parameter is specified. Save-DnsServerResourceRecord DirectoryPath Specifies the path to a target directory where DNS zone files will be saved. String String None Force Indicates that existing DNS zone files should be overwritten. SwitchParameter False InputObject Specifies a DNS resource record to save to a DNS zone file. DnsResourceRecord DnsResourceRecord None DirectoryPath Specifies the path to a target directory where DNS zone files will be saved. String String None Force Indicates that existing DNS zone files should be overwritten. SwitchParameter SwitchParameter False InputObject Specifies a DNS resource record to save to a DNS zone file. DnsResourceRecord DnsResourceRecord None DSInternals.Common.DNS.DnsResourceRecord None -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBDnsServerResourceRecord -DatabasePath 'C:\Backup\ntds.dit' | Save-DnsServerResourceRecord -Path '.\Zones' -Verbose Extracts all DNS resource records from the offline Active Directory database file and saves them to DNS zone files in the Zones directory. The cmdlet writes verbose information for each zone file that it creates. -------------------------- Example 2 -------------------------- PS C:\> Get-ADDBDnsServerResourceRecord -DatabasePath '.\ntds.dit' | Where-Object Zone -eq 'contoso.com' | Save-DnsServerResourceRecord -Path '.\Zones' -Force Saves records from the contoso.com zone to .\Zones\contoso.com.dns and overwrites an existing file if needed. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Save-DnsServerResourceRecord.md Get-ADDBDnsServerResourceRecord Get-ADDBDnsServerZone Save-DpapiBlob Save DpapiBlob Saves DPAPI and Credential Roaming data retrieved from Active Directory to the file system for further processing. This cmdlet saves DPAPI-related data retrieved from Active Directory to a selected directory. It also creates a file called kiwiscript.txt that contains mimikatz commands needed to decrypt the private keys and decode the certificates. Supports DPAPI backup keys returned by the Get-ADReplBackupKey, Get-ADDBBackupKey, and Get-LsaBackupKey cmdlets and roamed credentials (certificates, private keys, and DPAPI master keys) returned by the Get-ADReplAccount, Get-ADDBAccount, and Get-ADSIAccount cmdlets. Save-DpapiBlob DirectoryPath Specifies the path to a target directory where the output file(s) will be saved. String String None Account Specifies an Active Directory account whose DPAPI-related attribute values will be exported to the target directory. DSAccount DSAccount None Save-DpapiBlob DirectoryPath Specifies the path to a target directory where the output file(s) will be saved. String String None DPAPIObject Specifies a DPAPI object (e.g. Domain Backup Key or Master Key) that will be saved to the target directory. DPAPIObject DPAPIObject None Account Specifies an Active Directory account whose DPAPI-related attribute values will be exported to the target directory. DSAccount DSAccount None DirectoryPath Specifies the path to a target directory where the output file(s) will be saved. String String None DPAPIObject Specifies a DPAPI object (e.g. Domain Backup Key or Master Key) that will be saved to the target directory. DPAPIObject DPAPIObject None DSInternals.Common.Data.DPAPIObject DSInternals.Common.Data.DSAccount None -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBBackupKey -DatabasePath '.\ADBackup\Active Directory\ntds.dit' ` -BootKey 0be7a2afe1713642182e9b96f73a75da | Save-DpapiBlob -DirectoryPath '.\Output' PS C:\> Get-ADDBAccount -All -DatabasePath '.\ADBackup\Active Directory\ntds.dit' | Save-DpapiBlob -DirectoryPath '.\Output' PS C:\> Get-ChildItem -Path '.\Output' -Recurse -File | Foreach-Object { $PSItem.FullName.Replace((Resolve-Path -Path '.\Output'), '') } <# Sample Output: \kiwiscript.txt \ntds_capi_4cee80c0-b6c6-406c-a68b-c0e5818bc436.cer \ntds_capi_4cee80c0-b6c6-406c-a68b-c0e5818bc436.pfx \ntds_capi_4cee80c0-b6c6-406c-a68b-c0e5818bc436.pvk \ntds_legacy_d78736ad-5206-4eda-bfd4-cd10cc49d163.key \Abbi\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-1304\99c6f954ca07d75267f9a369a0bf5cd3_9e75a609-18c7-4c98-8cd0-c34c3aeae423 \Abbi\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-1304\ba7577742c7900c29f8e7f8193ca5f6d_9e75a609-18c7-4c98-8cd0-c34c3aeae423 \Abbi\Protect\S-1-5-21-4534338-1127018997-2609994386-1304\eadae2b5-3933-434a-9bcf-804175877104 \Abbi\SystemCertificates\My\Certificates\366004B5FA21294B80B22DA1385F414C70DF611B \Abbi\SystemCertificates\My\Certificates\6441367E7BF2D4C7DAA1CF27C72D6552F4A48B48 \Administrator\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-500\0b0c01d1f2bb6db4cd9496cd5e1214d6_f8b7bbef-d227-4ac7-badd-3a238a7f741e \Administrator\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-500\2907acacb201238bd89fe63b20c6d23b_f8b7bbef-d227-4ac7-badd-3a238a7f741e \Administrator\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-500\701577141985b6923998dcca035c007a_f8b7bbef-d227-4ac7-badd-3a238a7f741e \Administrator\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-500\d881dc8bbed7c3a08f03b01de4b9f45f_f8b7bbef-d227-4ac7-badd-3a238a7f741e \Administrator\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-500\e1b4cc613d831f27c664af17b8f98021_f8b7bbef-d227-4ac7-badd-3a238a7f741e \Administrator\Protect\S-1-5-21-4534338-1127018997-2609994386-500\47070660-c259-4d90-8bc9-187605323450 \Administrator\Protect\S-1-5-21-4534338-1127018997-2609994386-500\e13655bb-9519-45aa-abf8-a50a7b01317a \Administrator\SystemCertificates\My\Certificates\01ADA5237C2D2D1F1571247A239CA66B31885389 \Administrator\SystemCertificates\My\Certificates\5479CDDE0747E2CB5DF64F28A9E4AD3266AB27AF \Administrator\SystemCertificates\My\Certificates\574E4687133998544C0095C7B348C52CD398182E \Administrator\SystemCertificates\My\Certificates\B422F98237039C9836D24E22E5A92FCEC507EF89 \Administrator\SystemCertificates\My\Certificates\DBE2B5417D56BC061B05B7265A47D3595EEC6A32 \Administrator\SystemCertificates\Request\Certificates\AE1EBACC333E48E80C5DED7D0C644D80417CB6EC \Lara\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-1359\1eceade740dd71b94c3a7333522b9859_9e75a609-18c7-4c98-8cd0-c34c3aeae423 \Lara\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-1359\2995fb4c62c9211bc265c89fe1c85061_9e75a609-18c7-4c98-8cd0-c34c3aeae423 \Lara\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-1359\3183cd1aef41afc9af73e231607b5266_9e75a609-18c7-4c98-8cd0-c34c3aeae423 \Lara\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-1359\4f8bd0d10c208c8d57d2a1babd288a83_9e75a609-18c7-4c98-8cd0-c34c3aeae423 \Lara\Protect\S-1-5-21-4534338-1127018997-2609994386-1359\5f6d65d9-c363-4c78-af8d-034fb80efc5a \Lara\SystemCertificates\My\Certificates\1307CE05C8247AA08508302431B6A99647FF600E \Lara\SystemCertificates\My\Certificates\7B0928AF99A3244E73F7F17957ABD5A80818B210 \Lara\SystemCertificates\My\Certificates\90E1D7F90AD73F66F2C8F60120C256D038FD1F2C \Lara\SystemCertificates\My\Certificates\DB690E9D99D094D3E9746DE484D3050951516E29 \Logan\Crypto\RSA\S-1-5-21-4534338-1127018997-2609994386-1272\fd56f510920bd55b31ff5207eafda8c8_9e75a609-18c7-4c98-8cd0-c34c3aeae423 \Logan\Protect\S-1-5-21-4534338-1127018997-2609994386-1272\9c6cc9e0-b5f8-48f4-a478-305ad77fceab \Logan\SystemCertificates\My\Certificates\5D7A3A4FE8ADF5A61C5079EB7FDD1507B2753682 #> PS C:\> Get-Content -Path '.\Output\kiwiscript.txt' <# Sample Output: REM Add this parameter to at least the first dpapi::masterkey command: /pvk:"ntds_capi_290914ed-b1a8-482e-a89f-7caa217bf3c3.pvk" dpapi::masterkey /in:"Install\Protect\S-1-5-21-1236425271-2880748467-2592687428-1000\0f2ca69c-c144-4d80-905f-a6bcdfb0d659" /sid:S-1-5-21-1236425271-2880748467-2592687428-1000 dpapi::masterkey /in:"Install\Protect\S-1-5-21-1236425271-2880748467-2592687428-1000\acdad60e-bcc0-48fb-9ceb-7514ca5aa558" /sid:S-1-5-21-1236425271-2880748467-2592687428-1000 dpapi::cng /in:"Install\Crypto\Keys\002F8F86566CEFBC8694EE7F5BB24A5FF2BA2C18" dpapi::cng /in:"Install\Crypto\Keys\476D927F1B009662D46D785BA58BD8E9DB42F687" crypto::system /file:"Install\SystemCertificates\My\Certificates\EA4AD6192A82AB059BFA5E774515FDE0DA604160" /export crypto::system /file:"Install\SystemCertificates\My\Certificates\D6F23BB7BD8C0099DF5F1324507EA0CA3DE7DEAB" /export dpapi::masterkey /in:"john\Protect\S-1-5-21-1236425271-2880748467-2592687428-1109\bfefb3a6-5cdc-44f9-8521-a31feb3acdb1" /sid:S-1-5-21-1236425271-2880748467-2592687428-1109 dpapi::masterkey /in:"john\Protect\S-1-5-21-1236425271-2880748467-2592687428-1109\c14e7f69-3bf5-4c49-92d8-78d759d74ece" /sid:S-1-5-21-1236425271-2880748467-2592687428-1109 crypto::system /file:"john\SystemCertificates\My\Certificates\AF839B040D1257997A8D83EE71F96918F4C3EA01" /export dpapi::cng /in:"john\Crypto\Keys\9F95F8E4F381BFFFD22B5EFAA013E53268451310" dpapi::cng /in:"john\Crypto\Keys\C9ABDF8DC38EA2BA2E20AEC770D91210FF919F87" crypto::system /file:"john\SystemCertificates\My\Certificates\DEFFADB62EE547CB88973DF664C4DC958E8E64D8" /export crypto::system /file:"john\SystemCertificates\My\Certificates\49FD324E5CC4A6020AC9D12D4311C7B33393A1C4" /export crypto::system /file:"john\SystemCertificates\My\Certificates\4E951C29567A261B2E90C94BCCEFAE1FA878A2CB" /export dpapi::capi /in:"john\Crypto\RSA\S-1-5-21-1236425271-2880748467-2592687428-1109\0581f4e6088649266038726d9f8786a9_edc46440-65c9-41ce-aaeb-73754e0e38c8" dpapi::capi /in:"john\Crypto\RSA\S-1-5-21-1236425271-2880748467-2592687428-1109\4771dfabcc8ad1ec2c84c489df041fad_edc46440-65c9-41ce-aaeb-73754e0e38c8" #> Extracts DPAPI backup keys and roamed credentials (certificates, private keys, and DPAPI master keys) from an Active Directory database file and saves them to the Output directory. Also creates a file called kiwiscript.txt that contains mimikatz commands needed to decrypt the private keys. -------------------------- Example 2 -------------------------- PS C:\> Get-ADReplBackupKey -Server 'lon-dc1.adatum.com' | Save-DpapiBlob -DirectoryPath '.\Output' PS C:\> Get-ADReplAccount -All -Server 'lon-dc1.adatum.com' | Save-DpapiBlob -DirectoryPath '.\Output' Replicates all DPAPI backup keys and roamed credentials (certificates, private keys, and DPAPI master keys) from the target Active Directory domain controller and saves them to the Output directory. Also creates a file called kiwiscript.txt that contains mimikatz commands needed to decrypt the private keys. -------------------------- Example 3 -------------------------- PS C:\> Get-LsaBackupKey -ComputerName 'lon-dc1.contoso.com' | Save-DpapiBlob -DirectoryPath '.\Output' PS C:\> Get-ADSIAccount -Server 'lon-dc1.contoso.com' | Save-DpapiBlob -DirectoryPath '.\Output' Retrieves DPAPI backup keys from the target domain controller through the MS-LSAD protocol. Also retrieves roamed credentials (certificates, private keys, and DPAPI master keys) from this domain controller through LDAP and saves them to the Output directory. Also creates a file called kiwiscript.txt that contains mimikatz commands needed to decrypt the private keys. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Save-DpapiBlob.md Get-ADDBBackupKey Get-ADReplBackupKey Get-LsaBackupKey Get-ADReplAccount Get-ADDBAccount Get-ADSIAccount Save-DpapiNgSidKey Save DpapiNgSidKey Derives a SID-protected DPAPI-NG group key from a KDS root key and writes it to the local SID key cache. This cmdlet derives a SID-bound group key from the KDS root key whose identifier matches the supplied `ProtectionKeyIdentifier` and writes the resulting `KDSK` Group Key Envelope to the local SID key cache. The native DPAPI-NG implementation consults this cache during decryption, so seeding it offline allows subsequent DPAPI-NG operations (e.g. `Unprotect-DpapiNgData`, `Unprotect-DpapiNgPfxCertificate`, or `manage-bde -unlock -sid`) to succeed without contacting a domain controller. The `-KdsRootKey` parameter accepts an array of candidate root keys; the cmdlet picks the one whose `KeyId` matches the root key identifier embedded in the `KDSK` blob. The identifier can be supplied either as a parsed `ProtectionKeyIdentifier` (via `-Identifier`) or as the raw `KDSK` byte array (via `-IdentifierBlob`, which also accepts a hex string). The cmdlet does not return any output. Use the `-Verbose` switch to see the full path to the cache file that holds the envelope. Save-DpapiNgSidKey Identifier Specifies the parsed DPAPI-NG protection key identifier (`KDSK` blob) whose L0/L1/L2 cycle and root key identifier describe the group key to be derived. Typically obtained from `Get-DpapiNgSidKeyIdentifier`. ProtectionKeyIdentifier ProtectionKeyIdentifier None KdsRootKey Specifies one or more candidate KDS root keys. The cmdlet selects the key whose `KeyId` matches the supplied `Identifier`. KdsRootKey[] KdsRootKey[] None SecurityIdentifier Specifies the Security Identifier of the principal that is authorized to derive the group key. SecurityIdentifier SecurityIdentifier None Save-DpapiNgSidKey IdentifierBlob Specifies the raw `KDSK` Protection Key Identifier blob as a byte array. Also accepts a hex-encoded string, which is converted to bytes via `[AcceptHexString]`. Byte[] Byte[] None KdsRootKey Specifies one or more candidate KDS root keys. The cmdlet selects the key whose `KeyId` matches the supplied `Identifier`. KdsRootKey[] KdsRootKey[] None SecurityIdentifier Specifies the Security Identifier of the principal that is authorized to derive the group key. SecurityIdentifier SecurityIdentifier None Identifier Specifies the parsed DPAPI-NG protection key identifier (`KDSK` blob) whose L0/L1/L2 cycle and root key identifier describe the group key to be derived. Typically obtained from `Get-DpapiNgSidKeyIdentifier`. ProtectionKeyIdentifier ProtectionKeyIdentifier None IdentifierBlob Specifies the raw `KDSK` Protection Key Identifier blob as a byte array. Also accepts a hex-encoded string, which is converted to bytes via `[AcceptHexString]`. Byte[] Byte[] None KdsRootKey Specifies one or more candidate KDS root keys. The cmdlet selects the key whose `KeyId` matches the supplied `Identifier`. KdsRootKey[] KdsRootKey[] None SecurityIdentifier Specifies the Security Identifier of the principal that is authorized to derive the group key. SecurityIdentifier SecurityIdentifier None None None Alias: `Save-CngDpapiSidKey` -------------------------- Example 1 -------------------------- PS C:\> $rootKeys = Get-ADDBKdsRootKey -DatabasePath '.\ntds.dit' PS C:\> $keyId = Get-DpapiNgSidKeyIdentifier -Blob '010000004B44534B020000006C010000040000001C000000716B551C22ED5FC4723CDDBE199F682420000000180000001800000068838DA438D3C1CA36707F12B46B37776E0A3DB46ADB3DB2199D29E01976FCAE63006F006E0074006F0073006F002E0063006F006D00000063006F006E0074006F0073006F002E0063006F006D000000' PS C:\> Save-DpapiNgSidKey -Identifier $keyId -KdsRootKey $rootKeys -Sid 'S-1-5-21-3288850392-3299536932-2614793081-516' Reconstructs a SID-protected group key for the domain controllers group and seeds it into the local SID key cache so subsequent DPAPI-NG decryption can proceed offline. The cmdlet selects the root key whose `KeyId` matches the identifier from the array of candidates. -------------------------- Example 2 -------------------------- PS C:\> Save-DpapiNgSidKey -IdentifierBlob '010000004B44534B020000006C010000040000001C000000716B551C22ED5FC4723CDDBE199F682420000000180000001800000068838DA438D3C1CA36707F12B46B37776E0A3DB46ADB3DB2199D29E01976FCAE63006F006E0074006F0073006F002E0063006F006D00000063006F006E0074006F0073006F002E0063006F006D000000' -KdsRootKey (Get-ADDBKdsRootKey -DatabasePath '.\ntds.dit') -Sid 'S-1-5-21-3288850392-3299536932-2614793081-516' Passes the `KDSK` Protection Key Identifier as a hex string. The cmdlet converts it to bytes via `[AcceptHexString]` and parses the result into a `ProtectionKeyIdentifier`. -------------------------- Example 4 -------------------------- PS C:\> Save-DpapiNgSidKey -Identifier $keyId -KdsRootKey (Import-Clixml -Path .\KdsRootKeys.xml) -SecurityIdentifier S-1-5-21-3288850392-3299536932-2614793081-512 -Verbose <# Sample Output: VERBOSE: Saved DPAPI-NG SID key to 'C:\Users\John\AppData\Local\Microsoft\Crypto\KdsKey\b45c216c6b4390a526c9265a7926be9c9156980c7b2cb06c4f1a39acf0429765\PrivateKey\364-1c556b71-ed22-c45f-723c-ddbe199f6824'. #> PS C:\> manage-bde.exe -unlock e: -sid S-1-5-21-3288850392-3299536932-2614793081-512 <# Sample Output: BitLocker Drive Encryption: Configuration Tool version 10.0.26100 Copyright (C) 2013 Microsoft Corporation. All rights reserved. A SID-based Identity protector successfully unlocked the volume E:. #> Reconstructs the symmetric group key for a BitLocker SID-based Identity protector and seeds it into the local SID key cache. The KDS root key is loaded from a `Clixml` export (for example, captured earlier with `Get-ADSIKdsRootKey | Export-Clixml`). Once the key is cached, `manage-bde.exe -unlock -sid` succeeds offline; without the cached key the same command fails with "A SID-based Identity protector failed to unlock volume E:." Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Save-DpapiNgSidKey.md Clear-DpapiNgSidKeyCache Get-DpapiNgSidKeyIdentifier Get-ADDBKdsRootKey Get-ADReplKdsRootKey Get-ADSIKdsRootKey Unprotect-DpapiNgData Unprotect-DpapiNgPfxCertificate Set-ADDBAccountControl Set ADDBAccountControl Modifies user account control values for an Active Directory account in an offline ntds.dit file. Finds an account in Active Directory database file and modifies the appropriate bit(s) in its userAccountControl attribute. Set-ADDBAccountControl CannotChangePassword Indicates whether the account can change its password. Boolean Boolean None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Enabled Indicates whether the account is enabled. Boolean Boolean None Force Forces the cmdlet to perform the desired operation. SwitchParameter False HomedirRequired Indicates whether a home directory is required for the account. Boolean Boolean None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None PasswordNeverExpires Indicates whether the password of the account can expire. Boolean Boolean None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False SmartcardLogonRequired Indicates whether a smart card is required to logon. Boolean Boolean None UseDESKeyOnly Indicates whether the account is restricted to use only Data Encryption Standard (DES) encryption types for keys. Boolean Boolean None Set-ADDBAccountControl CannotChangePassword Indicates whether the account can change its password. Boolean Boolean None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Enabled Indicates whether the account is enabled. Boolean Boolean None Force Forces the cmdlet to perform the desired operation. SwitchParameter False HomedirRequired Indicates whether a home directory is required for the account. Boolean Boolean None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None PasswordNeverExpires Indicates whether the password of the account can expire. Boolean Boolean None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False SmartcardLogonRequired Indicates whether a smart card is required to logon. Boolean Boolean None UseDESKeyOnly Indicates whether the account is restricted to use only Data Encryption Standard (DES) encryption types for keys. Boolean Boolean None Set-ADDBAccountControl CannotChangePassword Indicates whether the account can change its password. Boolean Boolean None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Enabled Indicates whether the account is enabled. Boolean Boolean None Force Forces the cmdlet to perform the desired operation. SwitchParameter False HomedirRequired Indicates whether a home directory is required for the account. Boolean Boolean None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None PasswordNeverExpires Indicates whether the password of the account can expire. Boolean Boolean None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False SmartcardLogonRequired Indicates whether a smart card is required to logon. Boolean Boolean None UseDESKeyOnly Indicates whether the account is restricted to use only Data Encryption Standard (DES) encryption types for keys. Boolean Boolean None Set-ADDBAccountControl SamAccountName Specifies the identifier of an account on which to perform this operation. String String None CannotChangePassword Indicates whether the account can change its password. Boolean Boolean None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Enabled Indicates whether the account is enabled. Boolean Boolean None Force Forces the cmdlet to perform the desired operation. SwitchParameter False HomedirRequired Indicates whether a home directory is required for the account. Boolean Boolean None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None PasswordNeverExpires Indicates whether the password of the account can expire. Boolean Boolean None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False SmartcardLogonRequired Indicates whether a smart card is required to logon. Boolean Boolean None UseDESKeyOnly Indicates whether the account is restricted to use only Data Encryption Standard (DES) encryption types for keys. Boolean Boolean None CannotChangePassword Indicates whether the account can change its password. Boolean Boolean None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Enabled Indicates whether the account is enabled. Boolean Boolean None Force Forces the cmdlet to perform the desired operation. SwitchParameter SwitchParameter False HomedirRequired Indicates whether a home directory is required for the account. Boolean Boolean None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None PasswordNeverExpires Indicates whether the password of the account can expire. Boolean Boolean None SamAccountName Specifies the identifier of an account on which to perform this operation. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter SwitchParameter False SmartcardLogonRequired Indicates whether a smart card is required to logon. Boolean Boolean None UseDESKeyOnly Indicates whether the account is restricted to use only Data Encryption Standard (DES) encryption types for keys. Boolean Boolean None System.String System.Security.Principal.SecurityIdentifier System.Guid None -------------------------- Example 1 -------------------------- PS C:\> Set-ADDBAccountControl -SamAccountName john -SmartcardLogonRequired $false -PasswordNeverExpires $true -DatabasePath .\ntds.dit Finds an account with name john , disables the smart card logon requirement, and unexpires its password. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Set-ADDBAccountControl.md Set-ADDBAccountPassword Set-ADDBAccountPasswordHash Enable-ADDBAccount Disable-ADDBAccount Unlock-ADDBAccount Get-ADDBAccount Set-ADDBAccountPassword Set ADDBAccountPassword Sets the password for a user, computer, or service account stored in a ntds.dit file. Generates new password hashes of the given password, including NT hash, WDigest hashes and Kerberos DES, AES128 and AES256 keys and encrypts them into the database using boot key. Set-ADDBAccountPassword BootKey Specifies the boot key (AKA system key) that will be used to decrypt/encrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NewPassword Specifies a new password value. This value is stored as an encrypted string. SecureString SecureString None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Set-ADDBAccountPassword BootKey Specifies the boot key (AKA system key) that will be used to decrypt/encrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NewPassword Specifies a new password value. This value is stored as an encrypted string. SecureString SecureString None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Set-ADDBAccountPassword BootKey Specifies the boot key (AKA system key) that will be used to decrypt/encrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NewPassword Specifies a new password value. This value is stored as an encrypted string. SecureString SecureString None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Set-ADDBAccountPassword SamAccountName Specifies the identifier of an account on which to perform this operation. String String None BootKey Specifies the boot key (AKA system key) that will be used to decrypt/encrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NewPassword Specifies a new password value. This value is stored as an encrypted string. SecureString SecureString None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False BootKey Specifies the boot key (AKA system key) that will be used to decrypt/encrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NewPassword Specifies a new password value. This value is stored as an encrypted string. SecureString SecureString None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None SamAccountName Specifies the identifier of an account on which to perform this operation. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter SwitchParameter False System.Security.SecureString System.String System.Security.Principal.SecurityIdentifier System.Guid None -------------------------- Example 1 -------------------------- PS C:\> $pass = Read-Host -AsSecureString -Prompt 'Provide new password for user john' PS C:\> Set-ADDBAccountPassword -SamAccountName john ` -NewPassword $pass ` -DatabasePath '.\ADBackup\Active Directory\ntds.dit' ` -BootKey 0be7a2afe1713642182e9b96f73a75da Performs an offline password reset for user john . Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Set-ADDBAccountPassword.md Set-ADDBAccountPasswordHash Set-SamAccountPasswordHash Enable-ADDBAccount Disable-ADDBAccount Set-ADDBAccountControl Unlock-ADDBAccount Get-BootKey Get-ADDBAccount Set-ADDBAccountPasswordHash Set ADDBAccountPasswordHash Sets the password hash for a user, computer, or service account stored in a ntds.dit file. Writes the specified NT hash and optionally an entire supplementalCredentials data structure into an offline database. Also enables cross-database / cross-forest password migration without the requirement of a domain trust being in place. Set-ADDBAccountPasswordHash BootKey Specifies the boot key (AKA system key) that will be used to decrypt/encrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NTHash Specifies the NT hash of a password that will be written to the target AD database. Byte[] Byte[] None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False SupplementalCredentials Specifies the kerberos keys and WDigest hashes that will be written to the target AD database. SupplementalCredentials SupplementalCredentials None Set-ADDBAccountPasswordHash BootKey Specifies the boot key (AKA system key) that will be used to decrypt/encrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NTHash Specifies the NT hash of a password that will be written to the target AD database. Byte[] Byte[] None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False SupplementalCredentials Specifies the kerberos keys and WDigest hashes that will be written to the target AD database. SupplementalCredentials SupplementalCredentials None Set-ADDBAccountPasswordHash BootKey Specifies the boot key (AKA system key) that will be used to decrypt/encrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NTHash Specifies the NT hash of a password that will be written to the target AD database. Byte[] Byte[] None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False SupplementalCredentials Specifies the kerberos keys and WDigest hashes that will be written to the target AD database. SupplementalCredentials SupplementalCredentials None Set-ADDBAccountPasswordHash SamAccountName Specifies the identifier of an account on which to perform this operation. String String None BootKey Specifies the boot key (AKA system key) that will be used to decrypt/encrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NTHash Specifies the NT hash of a password that will be written to the target AD database. Byte[] Byte[] None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False SupplementalCredentials Specifies the kerberos keys and WDigest hashes that will be written to the target AD database. SupplementalCredentials SupplementalCredentials None BootKey Specifies the boot key (AKA system key) that will be used to decrypt/encrypt values of secret attributes. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NTHash Specifies the NT hash of a password that will be written to the target AD database. Byte[] Byte[] None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None SamAccountName Specifies the identifier of an account on which to perform this operation. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter SwitchParameter False SupplementalCredentials Specifies the kerberos keys and WDigest hashes that will be written to the target AD database. SupplementalCredentials SupplementalCredentials None System.Byte[] DSInternals.Common.Data.SupplementalCredentials System.String System.Security.Principal.SecurityIdentifier System.Guid None -------------------------- Example 1 -------------------------- PS C:\> $pass = Read-Host -AsSecureString -Prompt 'Provide new password for user hacker' PS C:\> $hash = ConvertTo-NTHash $pass PS C:\> Set-ADDBAccountPasswordHash -SamAccountName john ` -NTHash $hash ` -DatabasePath '.\ADBackup\Active Directory\ntds.dit' ` -BootKey 0be7a2afe1713642182e9b96f73a75da Performs an offline password reset for user john by injecting a raw NT hash value. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Set-ADDBAccountPasswordHash.md Set-ADDBAccountPassword Set-SamAccountPasswordHash Enable-ADDBAccount Disable-ADDBAccount Set-ADDBAccountControl Unlock-ADDBAccount Get-BootKey Get-ADDBAccount Set-ADDBBootKey Set ADDBBootKey Re-encrypts a ntds.dit file with a new BootKey/SysKey. Decrypts the password encryption key list from the pekList domain attribute using the current/old boot key and re-encrypts it using a new one. This might be useful during some DC restore operations. Note that this procedure is highly unsupported by Microsoft. Set-ADDBBootKey DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NewBootKey Specifies the new boot key (AKA system key) that will be used to re-encrypt the password encryption key (pekList) stored in the target Active Directory database. Byte[] Byte[] None OldBootKey Specifies the current boot key (AKA system key) that will be used to decrypt the password encryption key (pekList) stored in the target Active Directory database. Byte[] Byte[] None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None NewBootKey Specifies the new boot key (AKA system key) that will be used to re-encrypt the password encryption key (pekList) stored in the target Active Directory database. Byte[] Byte[] None OldBootKey Specifies the current boot key (AKA system key) that will be used to decrypt the password encryption key (pekList) stored in the target Active Directory database. Byte[] Byte[] None None None -------------------------- Example 1 -------------------------- PS C:\> Set-ADDBBootKey -DatabasePath 'C:\Backup\Active Directory\ntds.dit' ` -LogPath 'C:\Backup\Active Directory' ` -OldBootKey 610bc29e6f62ca7004e9872cd51a0116 ` -NewBootKey 6ffec6b70dc863db1906a5507c0576ee Re-encrypts the ntds.dit file with a new boot key. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Set-ADDBBootKey.md Get-BootKey New-ADDBRestoreFromMediaScript Set-ADDBDomainController Set ADDBDomainController Writes information about the DC to a ntds.dit file, including the highest committed USN and database epoch. The Set-ADDBDomainController cmdlet can be used to simulate USN rollbacks, USN depletion, and database file restore operations. This cmdlet should only be used in lab environments. Set-ADDBDomainController BackupExpiration Specifies the database backup expiration time. DateTime DateTime None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Confirms that you understand the implications of using this cmdlet and still want to use it. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None Set-ADDBDomainController DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Epoch Specifies the database epoch which must be consistent with the information in the registry. Int32 Int32 None Force Confirms that you understand the implications of using this cmdlet and still want to use it. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None Set-ADDBDomainController DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Confirms that you understand the implications of using this cmdlet and still want to use it. SwitchParameter False HighestCommittedUsn Specifies the highest committed USN for the database. Int64 Int64 None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None BackupExpiration Specifies the database backup expiration time. DateTime DateTime None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Epoch Specifies the database epoch which must be consistent with the information in the registry. Int32 Int32 None Force Confirms that you understand the implications of using this cmdlet and still want to use it. SwitchParameter SwitchParameter False HighestCommittedUsn Specifies the highest committed USN for the database. Int64 Int64 None LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None None None -------------------------- Example 1 -------------------------- PS C:\> $currentEpoch = Get-ItemPropertyValue -Path 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NTDS\Parameters' -Name 'DSA Database Epoch' PS C:\> Set-ADDBDomainController -DatabasePath .\ntds.dit -Epoch $currentEpoch -Force Copies the database epoch from registry to the ntds.dit file. -------------------------- Example 2 -------------------------- PS C:\> Set-ADDBDomainController -DatabasePath .\ntds.dit -HighestCommittedUsn 9223372036854775800 -Force Modifies the highest committed USN of the AD database. This might be helpful when trying to simulate USN rollbacks and USN depletion. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Set-ADDBDomainController.md Get-ADDBDomainController Set-ADDBBootKey Set-ADDBPrimaryGroup Set ADDBPrimaryGroup Modifies the primaryGroupId attribute of an object in a ntds.dit file. Modifies the primaryGroupId attribute of an account in a ntds.dit file. The most relevant group relative identifiers (RIDs) include 512 for Domain Admins , 513 for Domain Users , and 519 for Schema Admins . Set-ADDBPrimaryGroup DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an object on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None PrimaryGroupId Specifies the new primary group relative identifier (RID) that will be written to the database. Int32 Int32 None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Set-ADDBPrimaryGroup DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an object on which to perform this operation. Guid Guid None PrimaryGroupId Specifies the new primary group relative identifier (RID) that will be written to the database. Int32 Int32 None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Set-ADDBPrimaryGroup DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectSid Specifies the identifier of an object on which to perform this operation. SecurityIdentifier SecurityIdentifier None PrimaryGroupId Specifies the new primary group relative identifier (RID) that will be written to the database. Int32 Int32 None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Set-ADDBPrimaryGroup SamAccountName Specifies the identifier of an object on which to perform this operation. String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None PrimaryGroupId Specifies the new primary group relative identifier (RID) that will be written to the database. Int32 Int32 None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an object on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an object on which to perform this operation. Guid Guid None ObjectSid Specifies the identifier of an object on which to perform this operation. SecurityIdentifier SecurityIdentifier None PrimaryGroupId Specifies the new primary group relative identifier (RID) that will be written to the database. Int32 Int32 None SamAccountName Specifies the identifier of an object on which to perform this operation. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter SwitchParameter False System.Int32 System.String System.Security.Principal.SecurityIdentifier System.Guid None -------------------------- Example 1 -------------------------- PS C:\> Set-ADDBPrimaryGroup -SamAccountName John ` -PrimaryGroupId 512 ` -DatabasePath 'D:\Windows\NTDS\ntds.dit' Moves the account John from the default Domain Users group to Domain Admins . Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Set-ADDBPrimaryGroup.md Add-ADDBSidHistory Get-ADDBAccount Set-LsaPolicyInformation Set LsaPolicyInformation Configures AD-related Local Security Authority Policies of the local computer or a remote one. Configures AD-related Local Security Authority (LSA) Policies of the local or a remote computer. This functionality is helpful when restoring Active Directory domain controllers (DC) from IFM backups. Note that running this command against a DC with parameters that do not match the information stored in its local AD database might prevent the target DC from booting ever again. Set-LsaPolicyInformation ComputerName Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. The default is the local computer. To specify the local computer, such as in a list of computer names, use "localhost", the local computer name, or a dot (.). String String None DnsDomainName Specifies the DNS name of the primary domain. String String None DnsForestName Specifies the DNS forest name of the primary domain. This is the DNS name of the domain at the root of the enterprise. String String None DomainGuid Specifies the GUID of the primary domain. Guid Guid None DomainName Specifies the name of the primary domain. String String None DomainSid Specifies the SID of the primary domain. SecurityIdentifier SecurityIdentifier None ComputerName Specifies the target computer for the operation. Enter a fully qualified domain name (FQDN), a NetBIOS name, or an IP address. When the remote computer is in a different domain than the local computer, the fully qualified domain name is required. The default is the local computer. To specify the local computer, such as in a list of computer names, use "localhost", the local computer name, or a dot (.). String String None DnsDomainName Specifies the DNS name of the primary domain. String String None DnsForestName Specifies the DNS forest name of the primary domain. This is the DNS name of the domain at the root of the enterprise. String String None DomainGuid Specifies the GUID of the primary domain. Guid Guid None DomainName Specifies the name of the primary domain. String String None DomainSid Specifies the SID of the primary domain. SecurityIdentifier SecurityIdentifier None None None -------------------------- Example 1 -------------------------- PS C:\> Set-LsaPolicyInformation -DomainName 'ADATUM' ` -DnsDomainName 'Adatum.com' ` -DnsForestName 'Adatum.com' ` -DomainGuid 279b615e-ae79-4c86-a61a-50f687b9f7b8 ` -DomainSid S-1-5-21-1817670852-3242289776-1304069626 Configures AD-related LSA Policy Information of the local computer. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Set-LsaPolicyInformation.md New-ADDBRestoreFromMediaScript Set-SamAccountPasswordHash Set SamAccountPasswordHash Sets NT and LM hashes of an Active Directory or local account through the MS-SAMR protocol. Sets NT and LM password hashes of a user account in a local or remote Security Account Manager (SAM) or Active Directory (AD) database through the SAM Remote Protocol (MS-SAMR). Note that kerberos AES and DES ekeys of the target account are cleared by this command. Set-SamAccountPasswordHash Credential Specifies the user account credentials to be used to perform this task. The default credentials are the credentials of the currently logged on user. PSCredential PSCredential None Domain Specifies the target NetBIOS domain name the target account belongs to. String String None LMHash Specifies a new LM password hash value in hexadecimal format. Byte[] Byte[] None NTHash Specifies a new NT password hash value in hexadecimal format. Byte[] Byte[] None SamAccountName Specifies user's login. String String None Server Specifies the name of a SAM server. String String localhost Set-SamAccountPasswordHash Credential Specifies the user account credentials to be used to perform this task. The default credentials are the credentials of the currently logged on user. PSCredential PSCredential None LMHash Specifies a new LM password hash value in hexadecimal format. Byte[] Byte[] None NTHash Specifies a new NT password hash value in hexadecimal format. Byte[] Byte[] None Server Specifies the name of a SAM server. String String localhost Sid Specifies user SID. SecurityIdentifier SecurityIdentifier None Credential Specifies the user account credentials to be used to perform this task. The default credentials are the credentials of the currently logged on user. PSCredential PSCredential None Domain Specifies the target NetBIOS domain name the target account belongs to. String String None LMHash Specifies a new LM password hash value in hexadecimal format. Byte[] Byte[] None NTHash Specifies a new NT password hash value in hexadecimal format. Byte[] Byte[] None SamAccountName Specifies user's login. String String None Server Specifies the name of a SAM server. String String localhost Sid Specifies user SID. SecurityIdentifier SecurityIdentifier None System.String System.Security.Principal.SecurityIdentifier System.Byte[] None -------------------------- Example 1 -------------------------- PS C:\> Set-SamAccountPasswordHash -SamAccountName 'john' ` -Domain CONTOSO ` -NTHash ac5d3227c79791b451eb28fcd9efbfb2 ` -Server 'lon-dc1.contoso.com' Resets the NT password hash of the target Active Directory account through the MS-SAMR protocol. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Set-SamAccountPasswordHash.md Get-ADDBAccount Get-ADReplAccount Set-ADDBAccountPasswordHash Test-PasswordQuality Test PasswordQuality Performs AD audit, including checks for weak, duplicate, default and empty passwords. Accepts input from the Get-ADReplAccount and Get-ADDBAccount cmdlets. The Test-PasswordQuality cmdlet is a simple tool for Active Directory password auditing. It can detect weak, duplicate, default, non-expiring or empty passwords and find accounts that are violating security best practices. The cmdlet accepts output of the Get-ADDBAccount and Get-ADReplAccount cmdlets, so both offline (ntds.dit) and online (DCSync) password analysis can be done. Lists of leaked passwords that can be obtained from HaveIBeenPwned are fully supported. Be sure to download the list that is marked as "NTLM (ordered by hash)" and extract the archive to your HDD. Although the cmdlet output is formatted in a human readable fashion, it is still an object, whose properties can be accessed separately (e.g. $result.WeakPassword) to produce a desired output. When scripted, it can be used to audit Active Directory passwords on a regular basis. Test-PasswordQuality Account Active Directory account to check. The accounts are typically piped in from the Get-ADDBAccount and Get-ADReplAccount cmdlets. DSAccount DSAccount None IncludeDisabledAccounts Process even accounts that are disabled. Such accounts are skipped otherwise. SwitchParameter False SkipDuplicatePasswordTest Do not compare account hashes with each other. SwitchParameter False WeakPasswordHashesFile Path to a file that contains NT hashes of weak passwords, one hash in HEX format per line. For performance reasons, the -WeakPasswordHashesSortedFile parameter should be used instead. String String None WeakPasswordHashesSortedFile Path to a file that contains NT hashes of weak passwords, one hash in HEX format per line. The hashes must be sorted alphabetically, because a binary search is performed. This parameter is typically used with a list of leaked password hashes from HaveIBeenPwned, v8 and earlier. String String None WeakPasswords List of passwords that are considered weak, e.g. Password123 or April2019. If more than a handful passwords are to be tested, the WeakPasswordsFile parameter should be used instead. String[] String[] None WeakPasswordsFile Path to a file that contains weak passwords, one password per line. String String None Test-PasswordQuality Account Active Directory account to check. The accounts are typically piped in from the Get-ADDBAccount and Get-ADReplAccount cmdlets. DSAccount DSAccount None IncludeDisabledAccounts Process even accounts that are disabled. Such accounts are skipped otherwise. SwitchParameter False SkipDuplicatePasswordTest Do not compare account hashes with each other. SwitchParameter False WeakPasswordHashesFile Path to a file that contains NT hashes of weak passwords, one hash in HEX format per line. For performance reasons, the -WeakPasswordHashesSortedFile parameter should be used instead. String String None WeakPasswordHashesSortedFilePath Path to a directory of files named as the first five characters of an NT hash (00000.txt - FFFFF.txt), each of which contain NT hashes of weak passwords, one hash in HEX format per line, starting with the 6th character in the hash. The hashes must be sorted alphabetically, because a binary search is performed. This parameter is typically used with a list of leaked password hashes from HaveIBeenPwned after v8. String String None WeakPasswords List of passwords that are considered weak, e.g. Password123 or April2019. If more than a handful passwords are to be tested, the WeakPasswordsFile parameter should be used instead. String[] String[] None WeakPasswordsFile Path to a file that contains weak passwords, one password per line. String String None Account Active Directory account to check. The accounts are typically piped in from the Get-ADDBAccount and Get-ADReplAccount cmdlets. DSAccount DSAccount None IncludeDisabledAccounts Process even accounts that are disabled. Such accounts are skipped otherwise. SwitchParameter SwitchParameter False SkipDuplicatePasswordTest Do not compare account hashes with each other. SwitchParameter SwitchParameter False WeakPasswordHashesFile Path to a file that contains NT hashes of weak passwords, one hash in HEX format per line. For performance reasons, the -WeakPasswordHashesSortedFile parameter should be used instead. String String None WeakPasswordHashesSortedFile Path to a file that contains NT hashes of weak passwords, one hash in HEX format per line. The hashes must be sorted alphabetically, because a binary search is performed. This parameter is typically used with a list of leaked password hashes from HaveIBeenPwned, v8 and earlier. String String None WeakPasswordHashesSortedFilePath Path to a directory of files named as the first five characters of an NT hash (00000.txt - FFFFF.txt), each of which contain NT hashes of weak passwords, one hash in HEX format per line, starting with the 6th character in the hash. The hashes must be sorted alphabetically, because a binary search is performed. This parameter is typically used with a list of leaked password hashes from HaveIBeenPwned after v8. String String None WeakPasswords List of passwords that are considered weak, e.g. Password123 or April2019. If more than a handful passwords are to be tested, the WeakPasswordsFile parameter should be used instead. String[] String[] None WeakPasswordsFile Path to a file that contains weak passwords, one password per line. String String None DSInternals.Common.Data.DSAccount DSInternals.PowerShell.PasswordQualityTestResult -------------------------- Example 1 -------------------------- PS C:\> Get-ADDBAccount -All -DatabasePath ntds.dit -BootKey acdba64a3929261b04e5270c3ef973cf -Properties Secrets | Test-PasswordQuality -WeakPasswordHashesSortedFilePath P:\pwnedpasswords_ntlm <# Sample Output: Active Directory Password Quality Report ---------------------------------------- Passwords of these accounts are stored using reversible encryption: CONTOSO\smith CONTOSO\doe LM hashes of passwords of these accounts are present: CONTOSO\hodge These accounts have no password set: CONTOSO\test01 CONTOSO\test02 Passwords of these accounts have been found in the dictionary: CONTOSO\Administrator These groups of accounts have the same passwords: Group 1: CONTOSO\graham CONTOSO\graham_admin Group 2: CONTOSO\admin CONTOSO\sql_svc01 These user accounts have the SamAccountName as password: CONTOSO\sccm_admin These computer accounts have default passwords: CONTOSO\DESKTOP27$ Kerberos AES keys are missing from these accounts: CONTOSO\sql_svc01 Kerberos pre-authentication is not required for these accounts: CONTOSO\jboss Only DES encryption is allowed to be used with these accounts: CONTOSO\sql_svc01 These accounts are susceptible to the Kerberoasting attack: CONTOSO\Administrator CONTOSO\sp_svc01 CONTOSO\sql_svc02 These administrative accounts (current or former ones) are allowed to be delegated: CONTOSO\AdatumAdmin CONTOSO\Administrator Passwords of these accounts will never expire: CONTOSO\admin CONTOSO\sql_svc01 These accounts are not required to have a password: CONTOSO\gonzales These accounts that require smart card authentication have a password: CONTOSO\smithj CONTOSO\jonesp #> Performs an offline credential hygiene audit of AD database against HIBP. -------------------------- Example 2 -------------------------- PS C:\> $results = Get-ADReplAccount -All -Server LON-DC1 -Properties Secrets | Test-PasswordQuality -WeakPasswords 'Pa$$w0rd','April2019' ` -WeakPasswordHashesSortedFile pwned-passwords-ntlm-ordered-by-hash-v8.txt Performs an online credential hygiene audit of AD against HIBP + a custom wordlist. -------------------------- Example 3 -------------------------- PS C:\> $pwnedUsers = $accounts | Test-PasswordQuality -WeakPasswordsFile rockyou.txt -SkipDuplicatePasswordTest | Select-Object -ExpandProperty WeakPassword Performs a dictionary attack against a set of accounts. The Test-PasswordQuality cmdlet always returns structured data. -------------------------- Example 4 -------------------------- PS C:\> Get-ADDBAccount -All -DatabasePath ntds.dit -BootKey $key -Properties Secrets,DistinguishedName | where DistinguishedName -like '*OU=Employees,DC=contoso,DC=com' | Test-PasswordQuality -IncludeDisabledAccounts -WeakPasswordHashesSortedFilePath P:\pwnedpasswords_ntlm Performs an offline credential hygiene audit of a selected OU from AD database against HIBP. -------------------------- Example 5 -------------------------- PS C:\> $contosoAccounts = Get-ADReplAccount -All -Server LON-DC1.contoso.com PS C:\> $adatumAccounts = Get-ADReplAccount -All -Server NYC-DC1.adatum.com -Credential (Get-Credential) PS C:\> $contosoAccounts + $adatumAccounts | Test-PasswordQuality <# Sample Output (Partial): These groups of accounts have the same passwords: Group 1: ADATUM\smith ADATUM\doe Group 2: ADATUM\Administrator ADATUM\joe_admin CONTOSO\Administrator CONTOSO\joe_admin #> Performs a cross-forest duplicate password discovery. Any number of Get-ADReplAccount and Get-ADDBAccount cmdlet outputs can be combined together, as long as the computer has enough memory. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Test-PasswordQuality.md Get-ADDBAccount Get-ADReplAccount Unlock-ADDBAccount Unlock ADDBAccount Unlocks an Active Directory account in an offline ntds.dit file. Finds an account in Active Directory database file and sets its lockoutTime attribute to 0. Unlock-ADDBAccount DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Unlock-ADDBAccount DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Unlock-ADDBAccount DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False Unlock-ADDBAccount SamAccountName Specifies the identifier of an account on which to perform this operation. String String None DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter False DatabasePath Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit. String String None DistinguishedName Specifies the identifier of an account on which to perform this operation. String String None Force Forces the cmdlet to perform the desired operation. SwitchParameter SwitchParameter False LogPath Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself. String String None ObjectGuid Specifies the identifier of an account on which to perform this operation. Guid Guid None ObjectSid Specifies the identifier of an account on which to perform this operation. SecurityIdentifier SecurityIdentifier None SamAccountName Specifies the identifier of an account on which to perform this operation. String String None SkipMetaUpdate Indicates that the replication metadata of the affected object should not be updated. SwitchParameter SwitchParameter False System.String System.Security.Principal.SecurityIdentifier System.Guid None -------------------------- Example 1 -------------------------- PS C:\> Unlock-ADDBAccount -SamAccountName john -DatabasePath .\ntds.dit Finds an account with name john and unlocks it. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Unlock-ADDBAccount.md Enable-ADDBAccount Disable-ADDBAccount Get-ADDBAccount Unprotect-DpapiNgData Unprotect DpapiNgData Decrypts DPAPI-NG protected data. This cmdlet decrypts a DPAPI-NG protected blob. The `Blob` parameter accepts either a byte array or a base64-encoded `CngProtectedDataBlob`. By default, the cmdlet returns the decrypted data as a hexadecimal string. When `Encoding` is supplied, the cmdlet decodes the decrypted bytes and returns the decoded string. When `KdsRootKey` is supplied, the cmdlet derives and caches the matching SID group key before decrypting the blob, which enables offline decryption for SID-protected data. Unprotect-DpapiNgData Blob Specifies the DPAPI-NG protected blob as a byte array or base64 string. Byte[] Byte[] None Encoding Specifies the text encoding to use when returning decrypted data as a string. Accepts a `System.Text.Encoding` instance (such as `[System.Text.Encoding]::Unicode`) or one of the following well-known encoding names, which are also offered through tab completion: `ASCII`, `BigEndianUnicode`, `Unicode`, `UTF32`, `UTF7`, `UTF8`. Encoding Encoding None KdsRootKey Specifies the KDS root keys used to decrypt SID-protected data offline. KdsRootKey[] KdsRootKey[] None Blob Specifies the DPAPI-NG protected blob as a byte array or base64 string. Byte[] Byte[] None Encoding Specifies the text encoding to use when returning decrypted data as a string. Accepts a `System.Text.Encoding` instance (such as `[System.Text.Encoding]::Unicode`) or one of the following well-known encoding names, which are also offered through tab completion: `ASCII`, `BigEndianUnicode`, `Unicode`, `UTF32`, `UTF7`, `UTF8`. Encoding Encoding None KdsRootKey Specifies the KDS root keys used to decrypt SID-protected data offline. KdsRootKey[] KdsRootKey[] None System.Byte[] System.String Alias: `Unprotect-CngDpapiData` -------------------------- Example 1 -------------------------- PS C:\> $blob = Protect-DpapiNgData -Descriptor 'LOCAL=user' -Cleartext 'Secret' PS C:\> Unprotect-DpapiNgData -Blob $blob -Encoding Unicode <# Sample Output: Secret #> Decrypts a protected blob and returns the cleartext as a string. -------------------------- Example 2 -------------------------- PS C:\> Unprotect-DpapiNgData -Blob MIIBfgYJKoZIhvcNAQcDoIIBbzCCAWsCAQIxggEdooIBGQIBBDCB3ASBhAEAAABLRFNLAgAAAGwBAAAFAAAAAgAAAHFrVRwi7V/EcjzdvhmfaCQgAAAAGAAAABgAAADbXiCq9P/fSJ7/N+Pp/iN2B2WtpCgvzrvj0JscdeyQBGMAbwBuAHQAbwBzAG8ALgBjAG8AbQAAAGMAbwBuAHQAbwBzAG8ALgBjAG8AbQAAADBTBgkrBgEEAYI3SgEwRgYKKwYBBAGCN0oBATA4MDYwNAwDU0lEDC1TLTEtNS0yMS0zMjg4ODUwMzkyLTMyOTk1MzY5MzItMjYxNDc5MzA4MS01MTIwCwYJYIZIAWUDBAEtBCi/OCkpzyD9YKVGwFhAA7VGmfakng2fpmvMiG/DW4248BSlBDcfIFn+MEUGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMSAygtw55Qk5YcNtiAgEQgBiOh95J+ZwmKUL129c4D7lis40RYNLIs9g= -Encoding UTF8 -KdsRootKey (Get-ADDBKdsRootKey -DatabasePath '.\ntds.dit') <# Sample Output: Pa$$w0rd #> Decrypts a SID-protected blob offline by deriving the matching group key from a KDS root key read from an offline ntds.dit database, then returns the cleartext decoded as UTF-8. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Unprotect-DpapiNgData.md Get-DpapiNgData Protect-DpapiNgData Get-ADDBKdsRootKey Get-ADReplKdsRootKey Get-ADSIKdsRootKey Unprotect-DpapiNgPfxCertificate Unprotect DpapiNgPfxCertificate Decrypts the SID-based DPAPI-NG certificate password protector from a PFX file. This cmdlet decrypts the SID-protected certificate password embedded in a PKCS #12 PFX file and returns the populated `PfxProtectedPassword` object with the cleartext password attached. When the `KdsRootKey` parameter is not supplied, decryption is attempted online by using the current security context. When `KdsRootKey` is supplied, the cmdlet uses the matching KDS root key to derive and cache the SID group key before decrypting the certificate password offline. The input can be supplied either as a file `Path` or as a `PfxProtectedPassword` object (typically piped from Get-DpapiNgPfxCertificate (Get-DpapiNgPfxCertificate.md#get-dpapingpfxcertificate)). Unprotect-DpapiNgPfxCertificate InputObject Specifies an already-loaded `PfxProtectedPassword` to decrypt. PfxProtectedPassword PfxProtectedPassword None KdsRootKey Specifies KDS root keys that can be used to decrypt the protected certificate password offline. KdsRootKey[] KdsRootKey[] None Unprotect-DpapiNgPfxCertificate Path Specifies the path to the PFX file to load and decrypt. String String None KdsRootKey Specifies KDS root keys that can be used to decrypt the protected certificate password offline. KdsRootKey[] KdsRootKey[] None InputObject Specifies an already-loaded `PfxProtectedPassword` to decrypt. PfxProtectedPassword PfxProtectedPassword None KdsRootKey Specifies KDS root keys that can be used to decrypt the protected certificate password offline. KdsRootKey[] KdsRootKey[] None Path Specifies the path to the PFX file to load and decrypt. String String None System.String DSInternals.PowerShell.PfxProtectedPassword DSInternals.PowerShell.PfxProtectedPassword Alias: `Unprotect-CngDpapiPfxCertificate` -------------------------- Example 1 -------------------------- PS C:\> Unprotect-DpapiNgPfxCertificate -Path C:\Certificates\ContosoWildcard.pfx | Select-Object FilePath, Password <# Sample Output: FilePath Password -------- -------- C:\Certificates\ContosoWildcard.pfx 7+qwxfTcEBB2ySg5UipSl4fskvjwF6pqf4DEvlB0q7M= #> Decrypts the SID-protected certificate password by using the current security context. -------------------------- Example 2 -------------------------- PS C:\> $rootKeys = Get-ADDBKdsRootKey -DatabasePath '.\ntds.dit' PS C:\> Unprotect-DpapiNgPfxCertificate -Path C:\Certificates\ContosoWildcard.pfx -KdsRootKey $rootKeys | Select-Object FilePath, Password <# Sample Output: FilePath Password -------- -------- C:\Certificates\ContosoWildcard.pfx 7+qwxfTcEBB2ySg5UipSl4fskvjwF6pqf4DEvlB0q7M= #> Uses KDS root keys from an offline Active Directory database to decrypt the protected certificate password. -------------------------- Example 3 -------------------------- PS C:\> Get-DpapiNgPfxCertificate -Path C:\Certificates\ContosoWildcard.pfx | Unprotect-DpapiNgPfxCertificate | Select-Object FilePath, Password <# Sample Output: FilePath Password -------- -------- C:\Certificates\ContosoWildcard.pfx 7+qwxfTcEBB2ySg5UipSl4fskvjwF6pqf4DEvlB0q7M= #> Pipes a previously parsed `PfxProtectedPassword` into the decryption cmdlet. -------------------------- Example 4 -------------------------- PS C:\> Get-Item -Path C:\Certificates\*.pfx | Unprotect-DpapiNgPfxCertificate <# Sample Output: FilePath: C:\Certificates\ContosoWildcard.pfx Password: 7+qwxfTcEBB2ySg5UipSl4fskvjwF6pqf4DEvlB0q7M= EncryptedPassword Descriptor: SID=S-1-5-21-3288850392-3299536932-2614793081-519 OR SID=S-1-5-21-3288850392-3299536932-2614793081-512 ContentEncryptionAlgorithm: aes256gcm (2.16.840.1.101.3.4.1.46) SID/SDDL Protectors SID=S-1-5-21-3288850392-3299536932-2614793081-519 ProtectionKeyIdentifier: RootKey=1c556b71-ed22-c45f-723c-ddbe199f6824, Cycle=5/22/2026 6:00:00 AM (L0=364, L1=4, L2=22) KeyEncryptionAlgorithm: aes256wrap (2.16.840.1.101.3.4.1.45) SID=S-1-5-21-3288850392-3299536932-2614793081-512 ProtectionKeyIdentifier: RootKey=1c556b71-ed22-c45f-723c-ddbe199f6824, Cycle=5/22/2026 6:00:00 AM (L0=364, L1=4, L2=22) KeyEncryptionAlgorithm: aes256wrap (2.16.840.1.101.3.4.1.45) FilePath: C:\Certificates\ContosoWebServer.pfx Password: SUUlfn+1+S/9cmak+Rnd7tBK6yRSQWTAOMOXx8wCMZM= EncryptedPassword Descriptor: SID=S-1-5-21-3288850392-3299536932-2614793081-512 ContentEncryptionAlgorithm: aes256gcm (2.16.840.1.101.3.4.1.46) SID/SDDL Protectors SID=S-1-5-21-3288850392-3299536932-2614793081-512 ProtectionKeyIdentifier: RootKey=1c556b71-ed22-c45f-723c-ddbe199f6824, Cycle=5/22/2026 6:00:00 AM (L0=364, L1=4, L2=22) KeyEncryptionAlgorithm: aes256wrap (2.16.840.1.101.3.4.1.45) #> Enumerates all PFX files in the `C:\Certificates` directory and decrypts their SID-protected passwords by using the current security context. In contrast to Get-DpapiNgPfxCertificate (Get-DpapiNgPfxCertificate.md), the `Password` field now holds the recovered cleartext. Online Version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Unprotect-DpapiNgPfxCertificate.md Get-DpapiNgPfxCertificate Get-ADDBKdsRootKey Get-ADReplKdsRootKey Get-ADSIKdsRootKey