Active Directory Hygiene Check - ntds.dit compared against HaveIBeenPwned

Objective

The objective of this project is to improve Active Directory security by identifying user accounts that are using passwords already exposed in known data breaches. This is achieved by safely extracting NTLM password hashes from Active Directory and comparing them against the HaveIBeenPwned dataset, without ever accessing or revealing cleartext passwords. By highlighting compromised or high-risk credentials, the project enables informed remediation actions such as forced password resets and stronger policy enforcement, ultimately reducing the risk of credential-based attacks and unauthorized access within the Active Directory domain.

---

Skills Learned

• Active Directory Internals – Understanding how passwords are stored, how ntds.dit works, and the role of the SYSTEM hive and boot key
• Identity and Access Security – Assessing real-world credential exposure and understanding common attack paths involving compromised passwords
• Windows Forensics Fundamentals – Safely extracting and handling sensitive system files for offline analysis
• Risk Assessment and Remediation – Translating technical findings into actionable security decisions (password resets, policy changes, and user education)

---

Requirements

• Domain Admin account

---

Steps

Part 1: Download the HaveIBeenPwned NTLM Hash File (pwnedpasswords_ntlm.txt)

1. To install the HaveIBeenPwned downloader, you will need .NET 8.0. Download link for Windows: https://dotnet.microsoft.com/en-us/download/dotnet/8.0
2. Open Command Prompt and install the downloader:

   dotnet tool install --global haveibeenpwned_ntlm
   

   Note: The pwnedpasswords_ntlm.txt file contains millions of NTLM hashes collected from publicly disclosed data breaches. At the time of writing, the file size is approximately 69.3 GB.

---

Part 2: Back Up Your Active Directory Database

⚠️ Security Warning ⚠️ This procedure accesses some of the most sensitive files within a domain controller. Improper handling can introduce serious security risks or destabilize the system.

Best Practices

• Perform this process in a lab or test environment first
• Remove extracted files from the domain controller immediately after copying them to a secure location

---

1. Open Command Prompt as Administrator. We will use the built-in ntdsutil utility, specifically its Install From Media (IFM) functionality.

What IFM Does

It creates a consistent snapshot of the Active Directory database and supporting registry files. Although intended for provisioning new domain controllers, it is also one of the safest methods to extract ntds.dit for offline analysis.

⚠️ Depending on your Endpoint Detection and Response (EDR) solution or custom detection rules, this activity may trigger high-severity alerts.

1. Run the following commands:

   ntdsutil
   activate instance ntds
   ifm
   create full C:\temp\AD  # This directory location can vary depending on the location you want to output the results
   quit 
   quit
   

   Once complete, the following directories will be created:

   • C:\temp\AD\Active Directory\ → contains the ntds.dit file
   • C:\temp\AD\registry\ → contains the SYSTEM hive (boot key material)

Both files are required for the next step.

Tip: Copy these files to a secure host for analysis and delete them from the domain controller immediately after transfer.

---

Part 3: Extract NTLM Hashes with DSInternals

With both ntds.dit and the corresponding SYSTEM hive available, we can extract password hashes to perform an offline Active Directory hygiene check. We will use DSInternals, a PowerShell module by Michael Grafnetter, widely trusted for forensic and low-level Active Directory operations.

1. Install the DSInternals module:

Install-Module -Name DSInternals

1. Extract domain controller metadata from the offline Active Directory database:

Get-ADDBDomainController -DatabasePath '.\ntds.dit' # Enter entire ntds.dit filepath

1. Convert the SYSTEM hive into a usable boot key:

Get-Bootkey -SystemHiveFilePath '.\SYSTEM' # Enter entire SYSTEM hive file path

1. Extract password hashes and compare them against the HaveIBeenPwned dataset:

Get-ADDBAccount -All -DatabasePath '.\ntds.dit' -BootKey 'hexadecimal value from step 3' -Properties Secrets | Test-ADDBPasswordQuality -WeakPasswordHashesSortedFile '.\pwnedpasswords_ntlm.txt'

---

Part 4: Output

Once complete, this process generates a text-based Active Directory Password Quality Report containing accounts that use weak or compromised passwords.

(Example output shown for reference)

Passwords of these accounts are stored using reversible encryption:
  domain\smith
  domain\doe

LM hashes of passwords of these accounts are present:
  domain\hodge

These accounts have no password set:
  domain\test01
  domain\test02

Passwords of these accounts have been found in the dictionary:
  domain\Administrator

These groups of accounts have the same passwords:
  Group 1:
    domain\graham
    domain\graham_admin
  Group 2:
    domain\admin
    domain\sql_svc01

These user accounts have the SamAccountName as password:
  domain\sccm_admin

These computer accounts have default passwords:
  domain\DESKTOP27$

Kerberos AES keys are missing from these accounts:
  domain\sql_svc01

Kerberos pre-authentication is not required for these accounts:
 domain\jboss

Only DES encryption is allowed to be used with these accounts:
  domain\sql_svc01

These accounts are susceptible to the Kerberoasting attack:
  domain\Administrator
  domain\sp_svc01
  domain\sql_svc02

These administrative accounts (current or former ones) are allowed to be delegated:
  domain\AdatumAdmin
  domain\Administrator

Passwords of these accounts will never expire:
  domain\admin
  domain\sql_svc01

These accounts are not required to have a password:
  domain\gonzales

These accounts that require smart card authentication have a password:
  domain\smithj
  domain\jonesp

---

Notes

• Ensure all extracted files are handled securely and removed from production systems after use
• This process should only be performed in authorized environments
• Results should be used to enforce password resets and improve credential hygiene policies