Which file is critical to remove from a domain controller after a password audit?

wordlist.txt is a plaintext dictionary file used as cracking tool input and contains no extracted credential data from the domain, making it far less sensitive than the database itself.

john.pot stores passwords already cracked by John the Ripper and should also be securely deleted, but it represents a subset of already-cracked hashes rather than the complete raw credential database for the entire domain.

/etc/shadow is a Linux and Unix file containing hashed user passwords and does not exist on a Windows-based domain controller running Active Directory Domain Services.

ntds.dit is the primary Active Directory database residing on every domain controller and contains NTLM password hashes for every user account in the domain; leaving a copy on the domain controller after an audit means any attacker with file access could extract all domain credentials using tools like secretsdump, enabling complete domain compromise without additional exploitation.