General Dynamics Information Technology conducted an investigation analyzing an attacker dumping NTDS on the Domain Controller, finding that NTDS.dit stores domain information including password hashes for users.

GDIT is a global technology and professional services company that delivers solutions, technology and mission services to every major agency across the U.S. government, defense and intelligence community. Our 26,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across 50+ countries worldwide, offering leading capabilities in digital modernization, AI, cyber, and software development. GDIT is part of General Dynamics, a global aerospace and defense company. We have shared our customers’ sense of purpose for over half a century and have a unique understanding of their missions, complex environments, and a rapidly changing world. Together with our customers, we strive to create a safer, smarter world by harnessing the power of deep expertise and advanced technology.