Glossary
PEK (Password Encryption Key)
The key that encrypts every password hash inside NTDS.dit. The PEK list is itself wrapped with the domain controller's boot key.
The PEK (Password Encryption Key), sometimes called the domain key, is the
symmetric key that encrypts the password hashes stored in
NTDS.dit — the unicodePwd (NT) and dBCSPwd (LM)
attributes of every domain account.
A domain can rotate the PEK, so NTDS.dit actually holds a PEK list in the
pekList attribute. That list is encrypted with the domain controller's
boot key, so offline dumping is a two-step unwrap:
recover the boot key from the SYSTEM hive, decrypt the PEK list, then use the
right PEK to peel the RC4- or AES-encrypted layer off each hash. See
Inside NTDS.dit for the full derivation.