What built-in Windows tool can be used to collect Active Directory database data and the SYSTEM registry hive for off-line password cracking?

ntdsutil is a legitimate Windows command-line tool for managing the Active Directory Domain Services database. Attackers abuse its 'ifm' (Install from Media) feature to create a snapshot of the NTDS.dit file, which stores all AD user credential hashes. When paired with the SYSTEM hive - which holds the boot key (SYSKEY) needed to decrypt those hashes - the extracted data can be fed into tools like Impacket's secretsdump or hashcat for offline cracking.

procdump is a Sysinternals utility used to capture process memory dumps (such as LSASS memory for credential extraction), not to extract the Active Directory database file or registry hives.

Sysmon is a Windows system monitoring and logging service used by defenders for threat detection and forensics, not a tool for extracting AD credential data.

psinfo is a Sysinternals tool that retrieves general system configuration details from local or remote hosts, not Active Directory database contents or registry hives.