mimikatz DCSync

mimikatz # lsadump::dcsync /domain:<domain> /user:<domain>\krbtgt

Simulates directory replication to extract NTLM hashes from AD accounts, including krbtgt.

When you have credentials for an account with AD replication privileges (by default, Domain Admins, Enterprise Admins). DCSync allows obtaining hashes of all accounts without touching the local SAM. It is ideal for persistence (krbtgt) and escalation.

If the DC has advanced DCSync detections (Microsoft Defender ATP flags as 'Credential Access via DCSync'). Also not if the EDR blocks mimikatz. In those cases, use secretsdump.py from Linux.