Hi, self-promotion (again): I built https://github.com/almandin/ntdsdotsqlite a tool to parse NTDS files to get an SQLite database from it. I needed it for other projects I’m working on and thought it would be useful to others. It can decrypt hashes and other crypto stuff in the NTDS thanks to a modified (simplified) version of secretsdump I embed in the tool. It “only” extracts user accounts, machine accounts, org. units, groups and domain information at that time, if other object classes are needed it is easy to extend. All the common and useful attributes are extracted to perform useful security audits from the NTDS, or to save all useful hashes, password histories and kerberos keys.

Feel free to contribute and give feedback !