Retrieving Active Directory Passwords Remotely

August 4, 2015 | Michael Grafnetter

I have finally finished work on the Get-ADReplAccount cmdlet, the newest addition to my DSInternals PowerShell Module, that can retrieve reversibly encrypted plaintext passwords, password hashes and Kerberos keys of all user accounts from remote domain controllers. This is achieved by simulating the behavior of the dcromo tool and creating a replica of Active Directory database through the MS-DRSR protocol. Furthermore, it has these properties:

  • It does not even need the Domain Admins group membership. The Replicating Directory Changes All permission is more than enough for this cmdlet to do its job.
  • It opens door to other attacks, e.g. pass-the-hash, pass-the-ticket or PAC spoofing, that can be used to seize control of the entire Active Directory forest. Long live mimikatz!
  • It cannot be effectively blocked by firewalls, because the directory replication service (the DRSGetNCChanges call to be more precise) shares the same port with other critical services, like user name resolution (exposed by the DsCrackNames call).
  • It only uses documented features of Active Directory and is not a hack per se.
  • It leaves only minimal footprint on Domain Conrollers and can be easily overlooked by security audits.

Usage example:

Sample output:

You could even dump all accounts at once, but this can cause heavy (=suspicious) replication traffic:


Tags: , ,

«
»

88 comments on “Retrieving Active Directory Passwords Remotely”

  1. user says:
    April 3, 2016 at 22:53

    hi where do you read ClearText password from? from which user attribute?

    Reply
    • Michael Grafnetter says:
      April 3, 2016 at 23:15

      Hi, the cleartext password is contained in the secret supplementalCredentials attribute, which is never sent through LDAP.

      Reply
  2. user says:
    April 3, 2016 at 23:51

    Thank you. I have One more question: Wdigest hash is MD5 of user:realm:password. Real can be empty according to MS. However in your example none of MD5 matches the AprilPa$$w0rd MD5 ;/

    Reply
    • Michael Grafnetter says:
      April 4, 2016 at 00:36

      But the first one definitely matches “April:ADATUM:Pa$$w0rd”. See the MS article, but use colons instead of commas as delimiters.

      Reply
  3. B.K. says:
    May 7, 2016 at 07:00

    Thanks for the cool module. I am trying to export hashed password from windows 2008 R2 sp1. I have installed PowerShell 5 and install DSInternal from Powershell Gallery. But I got the following error message when I tries to dump all the user information. Is there anything to check to fix this issue?

    Thanks

    PS C:\Users\Administrator> Get-ADReplAccount -All -NamingContext ‘DC=xxxx,DC=xx’ -Server infraAD
    Get-ADReplAccount : Method not found: ‘IntPtr
    System.Runtime.InteropServices.Marshal.GetFunctionPointerForDelegate(!!0)’.
    At line:1 char:1
    + Get-ADReplAccount -All -NamingContext ‘DC=xxxx,DC=xx’ -Server i …
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [Get-ADReplAccount], MissingMethodException
    + FullyQualifiedErrorId : System.MissingMethodException,DSInternals.PowerShell.Commands.GetADReplAccountCommand

    Reply
    • Michael Grafnetter says:
      May 8, 2016 at 18:39

      Thx for the report. Could you please check your version of .NET Framework? Is it 4.5.1+?

      Reply
  4. B.K. says:
    May 9, 2016 at 02:09

    Thanks Michael. It is working fine after installing .NET 4.5.1. I was not working on .NET 4.5.

    B.K.

    Reply
  5. B.K. says:
    May 9, 2016 at 20:53

    I have one more question. Can we use this PowerShell in AD LDS? I just tried this one on AD LDS. It showed the following error message.

    PS C:\DSInternals> Get-ADReplAccount -All -NamingContext ‘cn=users,dc=idg,dc=ca’ -Server IDG:50000
    Get-ADReplAccount : The RPC server is unavailable
    At line:1 char:1
    + Get-ADReplAccount -All -NamingContext ‘cn=users,dc=idg,dc=ca’ -Server I …
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [Get-ADReplAccount], Win32Exception
    + FullyQualifiedErrorId : System.ComponentModel.Win32Exception,DSInternals.PowerShell.Commands.GetADReplAccountCom
    mand

    Reply
    • Michael Grafnetter says:
      May 22, 2016 at 16:53

      Only a few of the cmdlets work with AD LDS, like Get-ADDBDomainController against adamntds.dit. Regarding replication, I have not tried it yet, as it is not enabled by default.

      Reply
  6. Uwe says:
    June 30, 2016 at 06:20

    Hello,

    Could these functions used to do a sync of passwords between two domains. I tried to do

    Get-ADReplAccount and afterwards

    et-SamAccountPasswordHash -SamAccountName teste -Domain Test -NTHash $TestUser.NTHash

    There is a format issue with the NTHash.

    Could you give me a hand?

    Uwe

    Reply
    • Michael Grafnetter says:
      July 7, 2016 at 20:24

      Yes, Uwe, password sync is one of the reasons I created this tool for. Try this:
      Set-SamAccountPasswordHash -SamAccountName teste -Domain Test -NTHash (ConvertTo-Hex $TestUser.NTHash) The Set-SamAccountPasswordHash cmdlet only accepts hex string as NTHash, not a byte array. This is a design choice I made and it has both pros and cons.

      Reply
  7. John says:
    July 8, 2016 at 12:41

    Hi Michael, I have a quick question. The ClearText field is empty. Am I doing something wrong?

    Thank you

    Reply
    • Michael Grafnetter says:
      July 11, 2016 at 18:09

      Hi John, the ClearText field only contains a value if the option “Store password using reversible encryption” is enabled on the specific account or globally.

      Reply
  8. john says:
    July 12, 2016 at 13:40

    Hi, I selected “store password using reversible encryption” but it is still empty (clear text filed)

    Reply
  9. John says:
    July 12, 2016 at 16:36

    Hi Michael,
    my bad. I didn’t pay attention. Thank you. If the AD account doesn’t use reversible encryption and then later on I just check the “Store password using reversible encryption” will it display the password then?

    Reply
    • Michael Grafnetter says:
      July 12, 2016 at 19:28

      Even if you check that option, AD still does not know the cleartext password. The cleartext password will be saved as soon that user changes his password. The same is true with unchecking that option: The cleartext password will be deleted during the next password change.

      Reply
  10. John says:
    July 13, 2016 at 13:55

    I see. Thank you Michael.

    Reply
  11. Michael says:
    August 2, 2016 at 20:13

    Hi Michael, is it possible to Write the LMHash (in Detail the password without knowing it) back to another AD (for Sync) via PS or C#?

    Thanks for the GREAT! Work.
    Greets Michael

    Reply
    • Michael Grafnetter says:
      August 3, 2016 at 15:55

      NT/LM password hash writeback is possible using my Set-SamAccountPasswordHash PS cmdlet or the DSInternals.SAM NuGet .NET library, but I would stick to using NT hashes only. I have not found out a simple way of doing kerberos key writeback.

      Reply
  12. Laurent says:
    September 9, 2016 at 14:56

    Hello Michael,

    Would it be possible to restrict NamingContext to a specific OU in order to check security on a very specific OU instead of the whole AD?

    Second question : is it possible to define which kind of SamAccountType object to retrieve? I’ve tried to define SamAccountType User in addition to the request you provided but not working.

    Any help appreciated.

    Great job by the way, love it!

    Best
    Laurent

    Reply
    • Michael Grafnetter says:
      September 12, 2016 at 20:27

      Hello Laurent, the replication protocol by itself does not support such filters. But you could use
      Where-Object DistinguishedName -like "*,OU=" in the middle of the pipeline. Or, for small OUs, you could replicate the objects one by one:
      Get-ADUser -SearchBase "OU=..." -Filter * | Select-Object -Property ObjectGuid | Get-ADReplAccount ... | Test-...

      Reply
  13. Laurent says:
    September 13, 2016 at 13:17

    Worked perfectly, thanks a lot Michael!

    Reply
  14. Arsen says:
    September 26, 2016 at 19:02

    Hello Michael, I used Win10 with .NetFramework v.4.6.1, when I run the comman as you described, I’ve got an error: “Get-ADReplAccount : The distinguished name specified for this replication operation is invalid”.

    Could you please help with this?

    Reply
  15. Eduard says:
    October 7, 2016 at 18:14

    Hi Michael,

    Using your example, in the results that I get back the LMHash is empty. Is it also because the option “Store password using reversible encryption” is not enabled on the account or globally? Or is it something else?

    Thanks!

    Reply
  16. Kendall says:
    October 13, 2016 at 00:06

    I love that Get-ADReplAccount shows the ClearText password for accounts that have reversible encryption enabled. In your sample output above it shows the field “ClearText:” and that works fine in practice for me as well. However if I just want to create a list, using the following:

    get-aduser -filter * -searchbase … | Get-ADReplAccount -Domain … -Server … | select SamAccountName, ClearText The cleartext is blank.

    How can I access the ‘cleartext’ field without having to dump the full output of Get-AdReplAccount. Ideally, my output would be:

    SamAccountName, ClearText

    Sorry to bore you with a simple formating question, but I’m stumped.

    Reply
    • Michael Grafnetter says:
      October 15, 2016 at 10:58

      Hi Kendall,

      Try to do this:


      Get-ADReplAccount ... | select SamAccountName, @{ Name = 'ClearText'; Expression = { $PSItem.SupplementalCredentials.ClearText } }

      Cheers
      Michael

      Reply
  17. Kendall says:
    October 20, 2016 at 15:55

    Worked Perfectly! You are God-like.

    Thanks,

    Kendall

    Reply
  18. Todd says:
    December 19, 2016 at 19:21

    I get the following error:

    Get-ADReplAccount : Access is denied I verified the da account can run Powershell..

    This command works fine.

    powershell Invoke-Command -ComputerName dc1 -ScriptBlock { Get-ChildItem C:\ } -credential domain1\domainadm

    What other user rights does this need? The account is a Domain Admin.

    Its a Windows 2012R2 Domain functional level. The account is in the ‘Protected Users’ Group.

    Reply
  19. Todd says:
    January 5, 2017 at 16:36

    Yes. Apparently putting a Domain Admin in the Protected Users group will block this.

    Reply
    • Michael Grafnetter says:
      January 9, 2017 at 18:59

      OK, I will look into it, Todd. It would appear that only NTLM auth works with Get-ADReplAccount, not Kerberos, but I have to verify that.

      Reply
  20. Eduard says:
    January 5, 2017 at 23:10

    Hi Michael,

    What could be the reason that LM hashes from LMHashHistory do not match the actual passwords? For instance, When I generate the LM and NTLM hashes from the current password, Hash 01 from NTHashHistory matches, but Hash 01 from LMHashHistory does not match.

    Thanks,
    Eduard

    Reply
    • Michael Grafnetter says:
      January 9, 2017 at 19:02

      Hi Eduard, it might be caused by the fact that storing LM hashes is disabled by default since Windows Server 2003. A random value is probably stored in the history, I would guess.

      Reply
  21. Eduard says:
    January 6, 2017 at 01:16

    Michael,

    Another question: what are the WDigest hashes returned by Get-ADReplAccount? That is, where would they show up on the client machine?

    Thanks!
    Eduard

    Reply
    • Michael Grafnetter says:
      January 9, 2017 at 19:05

      Hi Eduard, the WDigest hashes are used during Digest/MD5 authentication, which Windows Server supports with HTTP (IIS) and LDAP (AD). It is a deprecated authentication scheme and should not be used. AD stores these hashes for compatibility reasons.

      Reply
  22. sam says:
    January 31, 2017 at 10:07

    Excellent work ! So I guess the default domain policy of having no reversible encryption is still safe as retrieving methods on this have not yet been found?

    Reply
    • Michael Grafnetter says:
      February 5, 2017 at 17:18

      Yes, the default policy is safe. But some companies had to enable storing passwords using reversible encryption because of legacy PAP VPN authentication. Personally, I have never been in such situation.

      Reply
  23. Joel says:
    February 25, 2017 at 01:25

    Michael,

    How do I pull the LMHash and WDigest hash information out of the DSAccount object? I’m storing the object in a variable like so:

    $TesterObject = Get-ADReplAccount -SamAccountName username -Domain DOMAINNAME -Server server.domain.org I see that LMHash is a system.byte but I’m having trouble converting that back into a string.

    Similarly with the WDigest if I reference $TesterObject.SupplementalCredentials.WDigest I get a byte array/

    Thanks!

    Reply
    • Michael Grafnetter says:
      March 7, 2017 at 14:48

      Dear Joel, you can use my ConvertTo-Hex cmdlet to convert byte[] to a hexadecimal string.

      Reply
  24. Peter says:
    March 3, 2017 at 04:18

    Thanks for producing this tool – fantastic! I hope you have a minute for a couple of questions:
    1- Is NTHash the value of UnicodePwd (just not base64-encoded) ?
    2- I’m trying to generate a complete list of users from AD to have all their attributes AND their UnicodePwd. Any idea if I can ask for other LDAP attributes with ‘Get-ADReplAccount’ or how to combine the output of this with that of ‘Get-ADUser’ to generate such a list?

    Reply
  25. Harpaslinh Zala says:
    March 7, 2017 at 11:14

    Hello Michael, I am trying to retrieve password from Windows 7 Computer with AD domain Credential however I am getting below error.

    PS C:\Windows\system32> $cred =Get-credential

    cmdlet Get-Credential at command pipeline position 1
    Supply values for the following parameters:
    Credential
    PS C:\Windows\system32> Get-ADReplAccount -SamAccountName zharpal -domain magoteaux -server rajkot-dc-02
    Get-ADReplAccount : Access is denied
    At line:1 char:1
    + Get-ADReplAccount -SamAccountName zharpal -domain magoteaux -server r …
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [Get-ADReplAccount], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,DSInternals.PowerShell.Commands.GetADReplAccountCo
    nd

    Reply
    • Michael Grafnetter says:
      March 7, 2017 at 15:01

      Dear Harpaslin, you have apparently skipped the -Credential parameter of the Get-ADReplAccount cmdlet.

      Reply
  26. Harpaslinh Zala says:
    March 8, 2017 at 08:57

    PS C:\Windows\system32> Import-Module dsinternals
    PS C:\Windows\system32> $cred = Get-Credential Get-ADReplAccount -SamAccountName zharpal -Domain magotteaux -Server rajkot-dc-02 -Credential $cred -Protocol TCP
    Get-Credential : A positional parameter cannot be found that accepts argument ‘Get-ADReplAccount’.
    At line:1 char:9
    + $cred = Get-Credential Get-ADReplAccount -SamAccountName zharpal -Dom …
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : InvalidArgument: (:) [Get-Credential], ParameterBindingException
    + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell.Commands.GetCredentialCommand I am getting as this error now.

    Reply
  27. Harpaslinh Zala says:
    March 8, 2017 at 08:58

    PS C:\Windows\system32> Import-Module dsinternals
    PS C:\Windows\system32> $cred = Get-Credential Get-ADReplAccount -SamAccountName zharpal -Domain magotteaux -Server rajkot-dc-02 -Credential $cred -Protocol TCP
    Get-Credential : A positional parameter cannot be found that accepts argument ‘Get-ADReplAccount’.
    At line:1 char:9
    + $cred = Get-Credential Get-ADReplAccount -SamAccountName zharpal -Dom …
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : InvalidArgument: (:) [Get-Credential], ParameterBindingException
    + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell.Commands.GetCredentialCommand

    Reply
  28. Harpaslinh Zala says:
    March 8, 2017 at 09:02

    I got result now but there is no clear Text so I can’t recover password now.

    PS C:\Windows\system32> Get-ADReplAccount -SamAccountName zharpal -Domain magotteaux -Server rajkot-dc-02 -Credential $c
    red -Protocol TCP

    DistinguishedName: CN=Zala Harpal,OU=Regular Accounts,OU=Mail,OU=Users,OU=Rajkot,OU=ASIA_PAC,DC=magotteaux,DC=org
    Sid: S-1-5-21-443316275-3401568197-975265098-16922
    Guid: cc9fba28-fc97-42e8-afea-271eaf8055ca
    SamAccountName: zharpal
    SamAccountType: User
    UserPrincipalName: zharpal@magotteaux.com
    PrimaryGroupId: 513
    SidHistory:
    Enabled: True
    UserAccountControl: NormalAccount
    AdminCount: False
    Deleted: False
    LastLogon:
    DisplayName: Zala Harpal
    GivenName: Zala
    Surname: Harpal
    Description: Information Technology
    ServicePrincipalName:
    SecurityDescriptor: DiscretionaryAclPresent, SystemAclPresent, DiscretionaryAclAutoInherited, SystemAclAutoInherited,
    SelfRelative
    Owner: S-1-5-21-443316275-3401568197-975265098-512
    NTHash: e5e9e197413856f5ca1a53df54d0d66c
    LMHash: c081b956d54a2ef28b88eb25b9c5dfca
    NTHashHistory:
    Hash 01: e5e9e197413856f5ca1a53df54d0d66c
    Hash 02: 531cfd9485f0b36e67044cff50076d17
    Hash 03: 3a95deb7a07780448aad279003bc5db0
    LMHashHistory:
    Hash 01: c081b956d54a2ef28b88eb25b9c5dfca
    Hash 02: c081b956d54a2ef2ff17365faf1ffe89
    Hash 03: c081b956d54a2ef21aa818381e4e281b
    SupplementalCredentials:
    ClearText:
    NTLMStrongHash:
    Kerberos:
    Credentials:
    DES_CBC_MD5
    Key: d9cb2338107920b3
    -140
    Key: e5e9e197413856f5ca1a53df54d0d66c
    OldCredentials:
    DES_CBC_MD5
    Key: 496854755b6e8c6d
    -140
    Key: 531cfd9485f0b36e67044cff50076d17
    Salt: MAGOTTEAUX.ORGzharpal
    Flags: 0
    KerberosNew:
    Credentials:
    AES256_CTS_HMAC_SHA1_96
    Key: 62fc62a23eb51f080f43e1f8e9b79dc1f97f40ced9fb4eed9ae1f5ac8a23687c
    Iterations: 4096
    AES128_CTS_HMAC_SHA1_96
    Key: 27a3d09ea1c1885de6afbac4c7b76896
    Iterations: 4096
    DES_CBC_MD5
    Key: d9cb2338107920b3
    Iterations: 4096
    -140
    Key: e5e9e197413856f5ca1a53df54d0d66c
    Iterations: 4096
    OldCredentials:
    AES256_CTS_HMAC_SHA1_96
    Key: 47987752a4d56dc4cd95114b0147978ba3399dc93b126f50de62b60ee99c7c3b
    Iterations: 4096
    AES128_CTS_HMAC_SHA1_96
    Key: 01a33041000d27c15d4a21d4c0740718
    Iterations: 4096
    DES_CBC_MD5
    Key: 496854755b6e8c6d
    Iterations: 4096
    -140
    Key: 531cfd9485f0b36e67044cff50076d17
    Iterations: 4096
    OlderCredentials:
    AES256_CTS_HMAC_SHA1_96
    Key: aa6caa7a47da316fc54385662c43bb6d777aefbd98714a03ad2dd5f9a10fab83
    Iterations: 4096
    AES128_CTS_HMAC_SHA1_96
    Key: ce670374a1f5dec8d3c42bc0dc031bc8
    Iterations: 4096
    DES_CBC_MD5
    Key: 9bc70e438f642f86
    Iterations: 4096
    -140
    Key: 549f8a5529710faec814f5eeb77c984a
    Iterations: 4096
    ServiceCredentials:
    Salt: MAGOTTEAUX.ORGzharpal
    DefaultIterationCount: 4096
    Flags: 0
    WDigest:
    Hash 01: e817f77d25c78915a0c67c8a6fd38a14
    Hash 02: 3c46a7a252f5d0582339e9029ebe62da
    Hash 03: c225be841b8eef0e0b245130563a1884
    Hash 04: e817f77d25c78915a0c67c8a6fd38a14
    Hash 05: 3c46a7a252f5d0582339e9029ebe62da
    Hash 06: 87c4dda7d2e2f1c61ba505af997ba741
    Hash 07: e817f77d25c78915a0c67c8a6fd38a14
    Hash 08: 7406d09efe1ccb5dab77e6d79fe54c58
    Hash 09: 7406d09efe1ccb5dab77e6d79fe54c58
    Hash 10: d6b774dba6bccd27d330a14995591f6b
    Hash 11: a17a5a4516dedf6eb5a051bcbb693d0e
    Hash 12: 7406d09efe1ccb5dab77e6d79fe54c58
    Hash 13: efbf1bda044e80cd1810b058f53d2193
    Hash 14: a17a5a4516dedf6eb5a051bcbb693d0e
    Hash 15: 6646d008bd0b39bc8ed0044c2d474c4e
    Hash 16: 6646d008bd0b39bc8ed0044c2d474c4e
    Hash 17: 237c05c30f800d51ccd4205bd102ecaa
    Hash 18: 8e52951364bdaff5caf97b2679f52579
    Hash 19: 22c089987ff1aa6db959e4864e56cffe
    Hash 20: 7b80c4fb70dbd502c236cb56cef0c99f
    Hash 21: 6944c61d63c483808c4ea31b65a0de56
    Hash 22: 6944c61d63c483808c4ea31b65a0de56
    Hash 23: cafb121216fe8be97a14d6db0fe92553
    Hash 24: db020ade5728f0b8e3232729cf3e75fc
    Hash 25: db020ade5728f0b8e3232729cf3e75fc
    Hash 26: d77bfbf442d9d7fafbbe7674ff6f9577
    Hash 27: 374de3f060fbf629d46434d34294c303
    Hash 28: f76e702a897886c1aef3676aac46f4db
    Hash 29: b53a9c8b7dbc4823447154fddb579d2f

    Reply
  29. Harpaslinh Zala says:
    March 10, 2017 at 07:12

    Dear Micheal,

    Please help to get clear text password.

    Reply
    • Michael Grafnetter says:
      March 12, 2017 at 18:30

      Dear Harpaslinh, the ClearText password is present only if you enable “Store passwords using reversible encryption” in AD. Regarding your previous examples, you apparently forgot to close the sub-command in parenthesis.

      Reply
  30. maurizio says:
    March 20, 2017 at 13:29

    Hi Michael, for some reason we are not allowed to build a trust between two forests. We must be able via LDAP to create user objects in forest/domain B by retrieving the user objects in domain/forest A. The user objects in domain B must have for some attributes the same values, like samAccount, last & first name. It is possible to “sync” the password hash from A to B so the user normally working in domain A can log on to domain B with the same samaccount and password?

    Reply
    • Michael Grafnetter says:
      March 24, 2017 at 00:39

      Yes, the Set-SamAccountPasswordHash cmdlet can do that. But only Kerberos-RC4 and NTLM(v2) authentication will work against such accounts.

      Reply
  31. Jeff says:
    April 2, 2017 at 20:44

    I keep getting an error for DSInternals.Replication.Interop.dll I have checked and the file is not locked. Any idea why?

    Get-ADReplAccount : A procedure imported by ‘DSInternals.Replication.Interop.dll’ could not be loaded.
    At line:1 char:1
    + Get-ADReplAccount -SamAccountName
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [Get-ADReplAccount], FileLoadException
    + FullyQualifiedErrorId : System.IO.FileLoadException,DSInternals.PowerShell.Commands.GetADReplAccountCommand

    Reply
    • Michael Grafnetter says:
      April 4, 2017 at 19:47

      Jeff, could you please specify your OS, PS version and also send me the stack trace of this exception? Thx.

      Reply
  32. Anonymous says:
    April 15, 2017 at 11:02

    Hi Michael, first its great stuff 🙂 I wonder how to check which users is member of Domain Admins or local Administrators ? The user blabla is member of Domain Admins and Administrators, but the module didn’t show this correct information even if I log off and log on again, also gpupdate /force on the client didn’t help.

    ***I’ve import the new and I hope the latest module 2.21***.
    I’m trying also (just for test) to check the store password using reversible encryptions for this specific user but the module didn’t get it.
    Please help :))) The Command that I’ve run on the Client:

    Get-ADReplAccount -All -NamingContext ‘DC=test,DC=local’ -Server srv12-01

    Output:

    DistinguishedName: CN=blabla,CN=Users,DC=test,DC=local
    Sid: S-1-5-21-2984388398-6913812-1553380050-2606
    Guid: e6012490-25a8-4f2f-ae66-2cf7822afcbc
    SamAccountName: blabla
    SamAccountType: User
    UserPrincipalName: blabla@test.local
    PrimaryGroupId: 513
    SidHistory:
    Enabled: True
    UserAccountControl: PlaintextPasswordAllowed, NormalAccount, PasswordNeverExpires
    AdminCount: False
    Deleted: False
    LastLogon:
    DisplayName: blabla
    GivenName: blabla
    Surname:
    Description:
    ServicePrincipalName:
    SecurityDescriptor: DiscretionaryAclPresent, SystemAclPresent,
    DiscretionaryAclAutoInherited, SystemAclAutoInherited, SelfRelative
    Owner: S-1-5-21-2984388398-6913812-1553380050-512
    …

    Reply
    • Michael Grafnetter says:
      April 19, 2017 at 17:36

      It might take up to 3 hours before the adminCount attribute changes from 0 to 1 after adding a user to Domain Admins. This is standard AD behavior. See this article.

      Reply
  33. jesus says:
    May 8, 2017 at 19:08

    hi Michael do you know any way to get the clear password from nthash in other words, can i get this data when active directory is 2008 o upper and “Store passwords using reversible encryption” is unchecked?

    Reply
    • Michael Grafnetter says:
      May 14, 2017 at 10:07

      Hey jesus, there is no way to get the cleartext password from the DB if it is not stored there. But you could try to attack the NTLM hash.

      Reply
  34. jesus says:
    May 16, 2017 at 09:12

    Hi Michael! I tried this but, i think since w2008 the lm hash is not stored in the A.D. do you know any way to get the lm hash in w2012?

    Reply
    • Michael Grafnetter says:
      July 11, 2018 at 13:23

      You can only extract the LM hash if it is stored in the DB in the first place. This is disabled by default on modern versions of Windows, but can be enabled by GPO (not recommended).

      Reply
  35. JD says:
    May 31, 2017 at 18:27

    Hey Michael, I’m using your code across domains but am being blocked by a firewall. What port needs to be open to run Get-ADReplAccount?

    Thanks in advance.

    Reply
  36. Seb says:
    June 9, 2017 at 12:40

    Hello Michael I see you use MS-DRSR in the DSInternals module to dump hashes from a DC.
    Can it be done locally without using MS-DRSR ? I need to dump hashes in order to sync them elsewhere, i’d like to avoid as much third party tools as possible (please take no offense), and just give the Ds-Replication-Get-Changes-All privilege to a service account and dump the hashes on the simplest way possible. Do you see a way to do so ?

    Thanks in advance

    Reply
    • Michael Grafnetter says:
      July 11, 2018 at 13:30

      You can either use MS-DRSR or password filters. There is no other online supported way of retrieving password hashes.

      Reply
  37. Grant says:
    June 28, 2017 at 22:35

    Hi Michael, we have disabled LM Hashes in the domain but there are a large number of accounts that still have them stored in AD because they haven’t updated their password. I’m using your tool to write a script to change them using a combination of Get-ADReplAccount and Set-SamAccountPasswordHash which is working quite well. I want to run this in a script and log the output fully but the problem I have is that the LMHash attribute of the users is stored in a byte array that needs to be converted to a string to log properly. This is obviously done for the Get-ADReplAccount command as it displays it in a string during the output.

    Can you point me to where that output is configured in the code source so I can use the same mechanism to output the LMhashes as strings in my script?

    Reply
  38. Grant says:
    June 28, 2017 at 23:36

    Nevermind I worked out a method using:
    “$($account.nthash | % {$_.tostring(“x”)})” -replace ” “,””

    Reply
  39. noobs says:
    August 15, 2017 at 07:12

    hi Michael,

    could you please show me how to use your ConvertTo-Hex cmdlet? current expression is :

    Get-ADReplicationaccount –all -Domain secret –server Test
    | select samaccountname, @{name = ‘NTHash’; Expression = {$PSItem.NTHash} } >……output.txt the output in the NThash column is {000,000,000,000…}

    Reply
    • Michael Grafnetter says:
      July 11, 2018 at 13:36

      @{name = ‘NTHash’; Expression = { ConvertTo-Hex $PSItem.NTHash} } Or you can use one of the Views instead, e.g.:
      Get-ADReplicationaccount –all -Domain secret –server Test | Format-Custom -View HashcatNT > output.txt

      Reply
  40. Michael says:
    August 16, 2017 at 16:46

    Seems like a really cool tool. Unfortunately for me, I get an unauthorizedaccessexception.

    Any ideas?

    + CategoryInfo : NotSpecified: (:) [Get-ADReplAccount], UnauthorizedAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,DSInternals.PowerShell.Commands.GetADReplAccountComma
    d

    Reply
    • Michael Grafnetter says:
      July 11, 2018 at 13:04

      Hi Michael, you apparently do not have the Replicating Directory Changes All permission.

      Reply
  41. Aikido_Man says:
    September 1, 2017 at 18:51

    I know this is an older post but I’m hoping you can still help.
    I’m able to pull the information I need from my server. How can I format the text to have SamAccountName NTHash.
    I’m using this command:
    Get-ADUser -SearchBase “OU=Admins,OU=company Users,DC=company,dc=com” -Filter * | Select-Object -Property ObjectGuid | Get-ADReplAccount -Server server1| select SamAccountName, @{Name = ‘NTHash’; Expression = {$PSItem.NTHash}}

    Problem is, it shows an ?array?
    UserA {247, 120, 183, 170…}
    UserB {183, 95, 226, 78…}
    UserC {103, 89, 154, 19…}

    Any Ideas How I can pull just the one hash that I can then run through hashcat.

    I’m trying to show my employer how weak our password policy is by cracking our own passwords. (maybe even his)

    Reply
  42. Nico says:
    September 5, 2017 at 16:50

    Dear Michael, I’ve looked at your source code but quite frankly this is on another level which I cannot possibly understand !
    I’d like to sync passwords via the NTLM hash between two ADs. Using the PS command this works perfectly, however I would like to write some C# code using your framework. Could you possible give some guidance on which dll’s I need to reference and the format of the commands to extract the hash on the source AD and then to set the hash in the target AD

    thanks

    Reply
    • Michael Grafnetter says:
      July 11, 2018 at 13:16

      Hi Nico, you should use the DSInternals.SAM and DSInternals.DataStore NuGet packages.

      Reply
  43. NKN says:
    November 14, 2017 at 18:36

    Hello Michael,

    I’m getting the below error when trying to load the module ,I have ver3 on my machine.

    Import-Module : The specified module ‘.\DSInternals\’ was not loaded because no valid module file was found in any
    module directory.
    At line:1 char:1
    + Import-Module .\DSInternals\
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : ResourceUnavailable: (.\DSInternals\:String) [Import-Module], FileNotFoundException
    + FullyQualifiedErrorId : Modules_ModuleNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand

    Reply
    • Michael Grafnetter says:
      July 11, 2018 at 13:15

      When loading the module from non-default locations, path to the DSInternals.psd1 module manifest has to be provided.

      Reply
  44. Ron Naeyaert says:
    August 27, 2018 at 18:48

    Hello

    Would this work for an ADLDS directory. If so what would the command look like to extract the hast for a user entry. The users are in ou=customers,ou=people,o=b2c.

    Thanks.

    Reply
    • Michael Grafnetter says:
      September 1, 2018 at 10:00

      Hi Ron, I have not implemented support for AD LDS into this cmdlet yet, as its schema is very flexible when compared with AD and it uses a different (and undocumented) data structure to store hashes.

      Reply
  45. Isaque Neves Sant Ana says:
    October 5, 2018 at 02:08

    I can not dump the password hashes of my ActiveDirectory

    my settings
    user: administrador
    pass: 1qaz2wsx..
    ip: 127.0.0.1
    port: 636
    user Dn: cn=administrador,cn=users,dc=labti,dc=info
    base dn: dc=labti,dc=info
    windows server 2012
    powershell 5

    commands

    PS C:\Users\Administrador> Get-ADReplAccount -All -NamingContext ‘DC=labti,DC=info’ -Server LON-DC1
    Get-ADReplAccount : RPC server is unavailable
    System.DirectoryServices.ActiveDirectory.ActiveDirectoryServerDownException,DSInternals.
    PowerShell.Commands.GetADReplAccountCommand

    PS C:\Users\Administrador> Get-ADReplAccount -SamAccountName ‘isaque.neves’ -Domain labti -Server LON-DC1 -Credential $c
    red -Protocol TCP
    Get-ADReplAccount : RPC server is unavailable

    Reply
    • Michael Grafnetter says:
      October 13, 2018 at 13:05

      Hi Isaque, that seems to be a firewall issue. The MS-DRSR protocol does not use LDAP. By default, you need TCP port 135 and 49152-65535 to be open.

      Reply
  46. Andrei Galkin says:
    October 22, 2018 at 14:20

    Hi Michael,

    You did great work. I have a question. Is there a way to get also password expire date with hashes or separately in DSInternals.

    Thanks
    Andrei

    Reply
    • Michael Grafnetter says:
      October 23, 2018 at 11:27

      Hi Andrei, this is currently not possible. You can mount a ntds.dit DB using dsamain.exe and get the pwdLastSet values. Expiration is complex, as you would need to analyse Fine-Grained Password Policies, not just the Default Domain Policy.

      Reply
  47. Dime says:
    October 24, 2018 at 09:08

    Hi Michael,

    what permission is required to run the script
    Get-ADReplAccount -All -Server $DC -NamingContext $Domain | Test-PasswordQuality ? domain admin only?

    thanks

    Reply
    • Michael Grafnetter says:
      October 24, 2018 at 19:27

      The Replicating Directory Changes All permission is required, which is by default only assigned to Administrators (and DCs).

      Reply
  48. goof says:
    November 28, 2018 at 01:30

    good joob

    Reply
  49. Rafael says:
    December 21, 2018 at 18:29

    Hello Michael, great Job!!!
    Already installed, but have one question. I’m passing an internal audit, and they asking me if I can demonstrate ntds.dit file have only ntlm v2 or kerberos hashes. Is there any way to doit with this?

    Reply
    • Michael Grafnetter says:
      December 22, 2018 at 13:04

      Sure! Use the Test-PasswordQuality cmdlet to check if there are any LM hashes present in the DB. Just note that there is no such thing as NTLMv2 hash. The hash function is actually called NT OWF (=one-way function), but I prefer calling it NT hash.

      Reply

Leave a Reply to Andrei Galkin Cancel reply

Your email address will not be published.