DSInternals PowerShell Module

DSInternals is a PowerShell module that exposes internal Active Directory features. It is primarily used for:

• Offline Active Directory operations: Manipulating ntds.dit files (e.g., password auditing, DC recovery, and account manipulation).
• Online Active Directory operations: Interacting with live Domain Controllers via protocols like MS-DRSR (Replication), MS-SAMR (Security Account Manager), MS-LSAD (Local Security Authority), and LDAP/ADSI.
• Security Auditing: FIDO2/NGC key auditing, password hash calculation, and exporting hashes for cracking tools.

The DSInternals.DataStore package provides direct access to and modification of the Active Directory database (ntds.dit) without the requirement of a running domain controller.

Key Capabilities:

• Password Hash Extraction: Retrieve NT hashes, LM hashes, and password history.
• Account Manipulation: Modify attributes such as sIDHistory and primaryGroupId.
• Security Key Extraction: Retrieve DPAPI backup keys, inter-domain trust passwords, Kerberos trust keys, and KDS root keys (for gMSA/dMSA).
• Decryption & Export: Decrypt Windows LAPS passwords, extract BitLocker recovery information, and export DNS resource records from AD-integrated zones.

The DSInternals.Common package is the foundational library for the DSInternals ecosystem. It provides core cryptographic functionality and abstractions for working with Active Directory security data, such as password hash computation and Kerberos key derivation.

Important Compatibility Note: This library uses Windows-specific cryptographic APIs via P/Invoke and is only supported on Windows.

The Get-ADKeyCredential cmdlet creates an object representing Windows Hello for Business (NGC), STK, or FIDO credentials. It can be used to:

• Display existing credentials from Active Directory.
• Generate new NGC credentials from self-signed certificates.
• Identify weak public keys (e.g., ROCA-vulnerable TPMs).
• Export RSA public key moduli for security auditing.
• Selectively delete credentials from Active Directory.

It supports several input methods via different parameter sets: providing an X.509 certificate, raw binary data, or DN-with-binary syntax.

The ADRepl command group is used for Active Directory replication tasks. Most commands inherit from ADReplCommandBase and require a -Server and optionally a -Credential (PSCredential).

Key commands include:

• GetADReplAccountCommand: Retrieves accounts with specific properties and formats.
• AddADReplSidHistoryCommand: Adds SID history to a principal, supporting source/destination domains and credentials.
• AddADReplNgcKeyCommand: Adds an NGC public key.
• GetADReplBackupKeyCommand and GetADReplKdsRootKeyCommand: Retrieve specific replication/KDS keys.

Command hierarchies:

• ADReplCommandBase -> ADReplObjectCommandBase -> ADReplPrincipalCommandBase (used by GetADReplAccountCommand, AddADReplNgcKeyCommand)
• ADReplCommandBase (used by GetADReplBackupKeyCommand, GetADReplKdsRootKeyCommand, AddADReplSidHistoryCommand)

The DSInternals module implements its binary PowerShell cmdlets using a structured class inheritance hierarchy. This hierarchy allows for shared logic across different command categories (Database, Replication, ADSI, LSA, and SAM).

When inspecting the command classes, you will see three types of members:

1. Public properties (+): These are exposed directly as PowerShell cmdlet parameters.
2. Protected properties (#): Internal state shared between derived classes, not visible in PowerShell.
3. Protected methods (#name()): Internal lifecycle overrides (like BeginProcessing, ProcessRecord, EndProcessing, Dispose) and helper methods.

Understanding this hierarchy helps in identifying which parameters are common across related cmdlets (e.g., Server and Credential are common in ADRepl, ADSI, and Sam command bases).

The Add-ADReplNgcKey cmdlet provides five different parameter sets to identify the target Active Directory object. You must use exactly one of the following methods:

1. ByName: Use SamAccountName and optionally Domain (NetBIOS name).
2. ByUPN: Use UserPrincipalName.
3. BySID: Use ObjectSid (Security Identifier).
4. ByDN: Use DistinguishedName (supports pipeline input).
5. ByGuid: Use ObjectGuid (supports pipeline input).

The SAM command group interacts with the Security Accounts Manager (SAM). Commands inherit from SamCommandBase and require a -Server and -Credential.

Key commands:

• GetSamPasswordPolicyCommand: Retrieves the SAM password policy. Supports the -UseNamedPipe switch.
• SetSamAccountPasswordHashCommand: Sets the password hash for a specific account using -SamAccountName, -Domain, -Sid, -NTHash (byte[]), and -LMHash (byte[]).

The Set-ADDBAccountPasswordHash cmdlet supports four different parameter sets to identify the target account. You must use exactly one of the following methods:

• ByName: Use -SamAccountName (e.g., john).
• BySID: Use -ObjectSid (a SecurityIdentifier).
• ByDN: Use -DistinguishedName (e.g., CN=John Doe,CN=Users,DC=example,DC=com).
• ByGuid: Use -ObjectGuid (a Guid).