Server 2012 R2

[csababarta]

Server 2012 R2

[csababarta]

I have just tested the framework with Server 2012 R2 and it seems to work. Can you send me some test data? I would need it in order to be able to reproduce the issue...

[bucky67gto]

I wish i could. the only data I have is from a live pentest I am doing. Did you get the same 14 tables in your export? did you run with datatable.4 and link_table.7? also, I am using NTDSXtract v1.3

[bucky67gto]

Did you get the same 14 tables in your export? did you run with datatable.4 and link_table.7? also, I am using NTDSXtract v1.3

[rufflabs]

I am noticing the same thing here. This is my first time doing this and I was wondering why my output didn't include any hashes like all the guides said it should.

I started searching and noticed that ntdsxtract said it only works on 2003 and 2008, while mine are 2012. I stumbled on this post when searching for ntdsxtract and server 2012.

Edit: For my issue I believe it was corrupted ntds or registry. I had initially taken the files from backups snapshots. When I took new snapshots with VSS and used those files it worked fine.

[304GEEK]

Same issue here.

MSysDefrag2.11 MSysObjids.2 link_table.7 sdpropcounttable.8
MSysLocales.3 datatable.4 quota_rebuild_progress_table.13 sdproptable.9
MSysObjects.0 hiddentable.5 quota_table.12
MSysObjectsShadow.1 link_history_table.6 sd_table.10

changing datable.# and link_table.# to match the output above, results are no -lmoutfile and -ntoutfile are not generated. some account details are presented.

Any progress working with this issue?

thanks,

[wgroenewold]

No issue here. Did you supply the SYSTEM hive?