Feature to extract Ntds.dit without touching disk?

[RogueThread]

Could this be implemented?

[jfjallid]

As far as I know, ntds.dit is not mapped to the windows registry so dumping that file is a bit out of scope for this tool.

The technique that comes to mind to dump the credentials without touching disk would be a dcsync which might be exposed via IPC (haven't checked).
I might take a look at that later and consider expanding the scope of this tool.