{"id":15021194,"url":"https://github.com/michaelgrafnetter/dsinternals","last_synced_at":"2026-10-19T10:17:42.954Z","repository":{"id":37550019,"uuid":"48581203","full_name":"MichaelGrafnetter/DSInternals","owner":"MichaelGrafnetter","description":" Directory Services Internals (DSInternals) PowerShell Module and Framework","archived":false,"fork":false,"pushed_at":"2026-09-11T22:31:26.000Z","size":19132,"stargazers_count":1969,"open_issues_count":22,"forks_count":275,"subscribers_count":78,"default_branch":"master","last_synced_at":"2026-10-09T21:02:03.842Z","etag":null,"topics":["active-directory","bitlocker","dns","dpapi","fido2","laps","lsa","ntds","nuget-packages","passwords","penetration-testing","powershell","sam","security-audit"],"latest_commit_sha":null,"homepage":"https://www.dsinternals.com","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MichaelGrafnetter.png","metadata":{"files":{"readme":".github/README.md","changelog":null,"contributing":".github/CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null},"funding":{"custom":"https://paypal.me/dsinternals"}},"created_at":"2015-12-25T13:23:05.000Z","updated_at":"2026-10-07T15:42:18.000Z","dependencies_parsed_at":"2023-01-24T01:45:59.564Z","dependency_job_id":"949dc36d-327f-4029-a226-444d62f03d43","html_url":"https://github.com/MichaelGrafnetter/DSInternals","commit_stats":{"total_commits":382,"total_committers":13,"mean_commits":"29.384615384615383","dds":0.0706806282722513,"last_synced_commit":"67fa4fa6015b94935f1a3505763d9c3242c390d0"},"previous_names":[],"tags_count":59,"template":false,"template_full_name":null,"purl":"pkg:github/MichaelGrafnetter/DSInternals","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MichaelGrafnetter%2FDSInternals","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MichaelGrafnetter%2FDSInternals/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MichaelGrafnetter%2FDSInternals/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MichaelGrafnetter%2FDSInternals/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MichaelGrafnetter","download_url":"https://codeload.github.com/MichaelGrafnetter/DSInternals/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MichaelGrafnetter%2FDSInternals/sbom","scorecard":{"id":93365,"data":{"date":"2025-08-11","repo":{"name":"github.com/MichaelGrafnetter/DSInternals","commit":"2db45336f63f4cfd714ba1fed4d6f40cd342e030"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.5,"checks":[{"name":"Code-Review","score":0,"reason":"Found 0/30 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Maintained","score":10,"reason":"21 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:22","Info: jobLevel 'packages' permission set to 'read': .github/workflows/codeql-analysis.yml:19","Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:21","Warn: no topLevel permission defined: .github/workflows/autobuild.yml:1","Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1","Warn: topLevel 'contents' permission set to 'write': .github/workflows/release.yml:44","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE.md:0","Info: FSF or OSI recognized license: MIT License: LICENSE.md:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Binary-Artifacts","score":9,"reason":"binaries present in source code","details":["Warn: binary detected: Scripts/Tools/vswhere.exe:1"],"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/autobuild.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/MichaelGrafnetter/DSInternals/autobuild.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/autobuild.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/MichaelGrafnetter/DSInternals/autobuild.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/MichaelGrafnetter/DSInternals/codeql-analysis.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/MichaelGrafnetter/DSInternals/codeql-analysis.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/MichaelGrafnetter/DSInternals/codeql-analysis.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/MichaelGrafnetter/DSInternals/codeql-analysis.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/MichaelGrafnetter/DSInternals/release.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/MichaelGrafnetter/DSInternals/release.yml/master?enable=pin","Info:   0 out of   5 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   3 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v5.4.1 not signed: https://api.github.com/repos/MichaelGrafnetter/DSInternals/releases/231186702","Warn: release artifact v5.3 not signed: https://api.github.com/repos/MichaelGrafnetter/DSInternals/releases/211799118","Warn: release artifact v5.2 not signed: https://api.github.com/repos/MichaelGrafnetter/DSInternals/releases/211265604","Warn: release artifact v5.1 not signed: https://api.github.com/repos/MichaelGrafnetter/DSInternals/releases/207624820","Warn: release artifact v5.0 not signed: https://api.github.com/repos/MichaelGrafnetter/DSInternals/releases/203320809","Warn: release artifact v5.4.1 does not have provenance: https://api.github.com/repos/MichaelGrafnetter/DSInternals/releases/231186702","Warn: release artifact v5.3 does not have provenance: https://api.github.com/repos/MichaelGrafnetter/DSInternals/releases/211799118","Warn: release artifact v5.2 does not have provenance: https://api.github.com/repos/MichaelGrafnetter/DSInternals/releases/211265604","Warn: release artifact v5.1 does not have provenance: https://api.github.com/repos/MichaelGrafnetter/DSInternals/releases/207624820","Warn: release artifact v5.0 does not have provenance: https://api.github.com/repos/MichaelGrafnetter/DSInternals/releases/203320809"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (1) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-15T08:20:28.077Z","repository_id":37550019,"created_at":"2025-08-15T08:20:28.077Z","updated_at":"2025-08-15T08:20:28.077Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38354641,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-19T02:00:06.414Z","response_time":53,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","bitlocker","dns","dpapi","fido2","laps","lsa","ntds","nuget-packages","passwords","penetration-testing","powershell","sam","security-audit"],"created_at":"2024-09-24T19:56:15.907Z","updated_at":"2026-10-19T10:17:42.949Z","avatar_url":"https://github.com/MichaelGrafnetter.png","language":"C#","funding_links":["https://paypal.me/dsinternals"],"categories":[],"sub_categories":[],"readme":"![DSInternals Logo](DSInternals-Dark.png#gh-light-mode-only)\n![DSInternals Logo](DSInternals-Light.png#gh-dark-mode-only)\n\n# Directory Services Internals\u003cbr/\u003ePowerShell Module and Framework\n\n[![MIT License](https://img.shields.io/badge/License-MIT-green.svg)](../LICENSE.md)\n[![PowerShell 5.1 | 7](https://badgen.net/badge/icon/5.1%20|%207?icon=terminal\u0026label=PowerShell)](#)\n[![Windows Server 2008 R2 | 2012 R2 | 2016 | 2019 | 2022 | 2025](https://badgen.net/badge/icon/2008%20R2%20|%202012%20R2%20|%202016%20|%202019%20|%202022%20|%202025?icon=windows\u0026label=Windows%20Server)](#)\n\n[![.NET Framework 4.8+](https://img.shields.io/badge/Framework-4.8%2B-007FFF.svg?logo=.net)](#)\n[![.NET 8.0+](https://img.shields.io/badge/Runtime-8.0%2B-007FFF.svg?logo=.net)](#)\n[![Architecture x64 | x86 | ARM64](https://img.shields.io/badge/Architecture-x64%20|%20x86%20|%20ARM64-0071c5.svg?logo=cplusplus)](#)\n\n## Introduction\n\nThe DSInternals project consists of these two parts:\n- The [DSInternals Framework](https://www.nuget.org/profiles/DSInternals) exposes several internal features of *Active Directory* and can be used from any .NET application. The codebase has already been integrated into several 3\u003csup\u003erd\u003c/sup\u003e party commercial products that use it in scenarios like Active Directory disaster recovery, identity management, cross-forest migrations and password strength auditing.\n- The [DSInternals PowerShell Module](https://www.powershellgallery.com/packages/DSInternals/) provides easy-to-use cmdlets that are built on top of the Framework. These are the main features:\n  - [Active Directory password auditing](../Documentation/PowerShell/Test-PasswordQuality.md#test-passwordquality) that discovers accounts sharing the same passwords or having passwords in a public database like [HaveIBeenPwned](https://haveibeenpwned.com) or in a custom dictionary.\n  - DPAPI-NG (CNG DPAPI) [data protection and decryption](../Documentation/PowerShell/Protect-DpapiNgData.md#protect-dpapingdata), management of [named protection descriptors](../Documentation/PowerShell/New-DpapiNgNamedDescriptor.md#new-dpapingnameddescriptor), decryption of [SID-protected PFX certificates](../Documentation/PowerShell/Unprotect-DpapiNgPfxCertificate.md#unprotect-dpapingpfxcertificate), and [offline unlock of BitLocker SID-based key protectors](../Documentation/PowerShell/Save-DpapiNgSidKey.md#save-dpapingsidkey) by deriving DPAPI-NG group keys from KDS root keys.\n  - [Key credential auditing and generation](../Documentation/PowerShell/Get-ADKeyCredential.md#get-adkeycredential), including support for NGC, FIDO2 and STK keys. Keys can also be tested against the [ROCA vulnerability](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190026). New NGC keys can also be [registered through the MS-DRSR protocol](../Documentation/PowerShell/Add-ADReplNgcKey.md#add-adreplngckey).\n  - [Bare-metal recovery of domain controllers](../Documentation/PowerShell/New-ADDBRestoreFromMediaScript.md#new-addbrestorefrommediascript) from just IFM backups (ntds.dit + SYSVOL).\n  - Offline ntds.dit file manipulation, including [hash dumping](../Documentation/PowerShell/Get-ADDBAccount.md#get-addbaccount), [password resets](../Documentation/PowerShell/Set-ADDBAccountPassword.md#set-addbaccountpassword), [group membership changes](../Documentation/PowerShell/Set-ADDBPrimaryGroup.md#set-addbprimarygroup), [trust password extraction](../Documentation/PowerShell/Get-ADDBTrust.md#get-addbtrust), [Golden gMSA and dMSA attacks](../Documentation/PowerShell/Get-ADDBServiceAccount.md#get-addbserviceaccount), [enabling](../Documentation/PowerShell/Enable-ADDBAccount.md#enable-addbaccount)/[disabling](../Documentation/PowerShell/Disable-ADDBAccount.md#disable-addbaccount) accounts, [LAPS password decryption](../Documentation/PowerShell/Get-ADDBAccount.md#example-9), and [BitLocker recovery key extraction](../Documentation/PowerShell/Get-ADDBBitLockerRecoveryInformation.md#get-addbbitlockerrecoveryinformation).\n  - Active Directory–integrated DNS zone and resource record reading from both [`ntds.dit`](../Documentation/PowerShell/Get-ADDBDnsServerZone.md#get-addbdnsserverzone) and [the live directory over LDAP](../Documentation/PowerShell/Get-ADSIDnsServerZone.md#get-adsidnsserverzone), [export to standard zone files](../Documentation/PowerShell/Save-DnsServerResourceRecord.md#save-dnsserverresourcerecord), and extraction of [DNSSEC Key Signing Keys (KSK) and Zone Signing Keys (ZSK)](../Documentation/PowerShell/Export-ADDBDnsServerSigningKey.md#export-addbdnsserversigningkey), with private keys decrypted using KDS root keys.\n  - [Online password hash dumping](../Documentation/PowerShell/Get-ADReplAccount.md#get-adreplaccount) through the Directory Replication Service (DRS) Remote Protocol (MS-DRSR). This feature is commonly called DCSync.\n  - [Domain or local account password hash injection](../Documentation/PowerShell/Set-SamAccountPasswordHash.md#set-samaccountpasswordhash) through the Security Account Manager (SAM) Remote Protocol (MS-SAMR) or [directly into the database](../Documentation/PowerShell/Set-ADDBAccountPasswordHash.md#set-addbaccountpasswordhash).\n  - [LSA Policy modification](../Documentation/PowerShell/Set-LsaPolicyInformation.md#set-lsapolicyinformation) through the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD / LSARPC).\n  - [Extracting credential roaming data](../Documentation/PowerShell/Save-DPAPIBlob.md#save-dpapiblob) and DPAPI domain backup keys, either online through [directory replication](../Documentation/PowerShell/Get-ADReplBackupKey.md#get-adreplbackupkey), [LSARPC](../Documentation/PowerShell/Get-LsaBackupKey.md#get-lsabackupkey), and [offline from ntds.dit](../Documentation/PowerShell/Get-ADDBBackupKey.md#get-addbbackupkey).\n  - Password hash calculation, including [NT hash](../Documentation/PowerShell/ConvertTo-NTHash.md#convertto-nthash), [LM hash](../Documentation/PowerShell/ConvertTo-LMHash.md#convertto-lmhash), and [kerberos keys](../Documentation/PowerShell/ConvertTo-KerberosKey.md#convertto-kerberoskey).\n\n\u003e [!WARNING]\n\u003e Features exposed through these tools are not supported by Microsoft. Improper use might cause irreversible damage to domain controllers or negatively impact domain security.\n\n## Author\n\n### Michael Grafnetter\n\n[![Twitter](https://img.shields.io/twitter/follow/MGrafnetter.svg?label=Twitter%20@MGrafnetter\u0026style=social)](https://x.com/MGrafnetter)\n[![Blog](https://img.shields.io/badge/Blog-www.dsinternals.com-2A6496.svg)](https://www.dsinternals.com/en)\n[![LinkedIn](https://img.shields.io/badge/LinkedIn-grafnetter-0077B5.svg)](https://www.linkedin.com/in/grafnetter)\n\nI have created these tools in my spare time and I am using them while performing AD security audits and also in my lectures to demonstrate how Active Directory works internally.\n\nI would like to thank all people who have contributed to the project by [sending their feedback](https://github.com/MichaelGrafnetter/DSInternals/issues) or by [submitting their code](https://github.com/MichaelGrafnetter/DSInternals/graphs/contributors). In case you would also like to help with this project, please see the [CONTRIBUTING](CONTRIBUTING.md#contributing-to-dsinternals) document.\n\n## Downloads\n\n[![PowerShell Gallery Downloads](https://img.shields.io/powershellgallery/dt/DSInternals.svg?label=PowerShell%20Gallery%20Downloads\u0026logo=NuGet)](https://www.powershellgallery.com/packages/DSInternals/)\n[![Chocolatey Downloads](https://img.shields.io/chocolatey/dt/dsinternals-psmodule.svg?label=Chocolatey%20Downloads\u0026logo=NuGet)](https://chocolatey.org/packages/dsinternals-psmodule)\n[![GitHub Downloads](https://img.shields.io/github/downloads/MichaelGrafnetter/DSInternals/total.svg?label=GitHub%20Downloads\u0026logo=GitHub)](https://github.com/MichaelGrafnetter/DSInternals/releases)\n[![NuGet Gallery Downloads](https://img.shields.io/nuget/dt/DSInternals.Common.svg?label=NuGet%20Gallery%20Downloads\u0026logo=NuGet)](https://www.nuget.org/profiles/DSInternals)\n\n### PowerShell Gallery\n\nYou can install the DSInternals module directly from the official [PowerShell Gallery](https://www.powershellgallery.com/packages/DSInternals/) by running the following command:\n\n```powershell\nInstall-Module DSInternals -Force\n```\n\nAdditional steps might be required on some freshly installed computers before DSInternals can be downloaded:\n\n```powershell\n# TLS 1.2 must be enabled on older versions of Windows.\n[System.Net.ServicePointManager]::SecurityProtocol =\n    [System.Net.ServicePointManager]::SecurityProtocol -bor [System.Net.SecurityProtocolType]::Tls12\n\n# Download the NuGet package manager binary.\nInstall-PackageProvider -Name NuGet -Force\n\n# Register the PowerShell Gallery as package repository if it is missing for any reason.\nif($null -eq (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue)) {\n    Register-PSRepository -Default\n}\n\n# Download the DSInternals PowerShell module.\nInstall-Module -Name DSInternals -Force\n```\n\n### Chocolatey Package\n\nThe DSInternals PowerShell Module can also be installed using the official [Chocolatey package](https://chocolatey.org/packages/dsinternals-psmodule) by executing the following Chocolatey command:\n\n```powershell\nchoco install dsinternals-psmodule --confirm\n```\n\nThis package is self-contained and it will also install all dependencies. Note that package versions prior to 3.5 were not official.\n\n### WAPT Package\n\nThe DSInternals PowerShell Module can also be installed using the [WAPT package](https://wapt.tranquil.it/store/en/tis-dsinternals).\n\nThe package can be installed by the [WAPT console](https://www.wapt.fr/en/doc/wapt-console-usage.html) or by the [WAPT Command-line interface](https://www.wapt.fr/en/doc/wapt-command-line-interface.html) like so:\n\n```powershell\nwapt-get install dsinternals\n```\n\nThis package is self-contained and it will also install all dependencies.\n\n### Offline Module Distribution\n\n1. Download the [current release](https://github.com/MichaelGrafnetter/DSInternals/releases) from GitHub.\n2. *Unblock* the ZIP file, using either the *Properties dialog* or the `Unblock-File` cmdlet. If you fail to do so, all the extracted DLLs will inherit this attribute and PowerShell will refuse to load them.\n3. Extract the *DSInternals* directory to your PowerShell modules directory, e.g. *C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\DSInternals* or *C:\\Users\\John\\Documents\\WindowsPowerShell\\Modules\\DSInternals*.\n4. (Optional) If you copied the module to a different directory than advised in the previous step, you have to manually import it using the `Import-Module` cmdlet.\n\n### Commando VM\n\nThe DSInternals PowerShell module is part of FireEye's [Commando VM](https://github.com/fireeye/commando-vm), the Windows-based alternative to Kali Linux.\n\n### NuGet Packages\n\nThe easiest way of integrating the DSInternals functionality into .NET applications is by using the [DSInternals Framework NuGet packages](https://www.nuget.org/profiles/DSInternals):\n\n- [DSInternals.Common](https://www.nuget.org/packages/DSInternals.Common/)\n- [DSInternals.DataStore](https://www.nuget.org/packages/DSInternals.DataStore/)\n- [DSInternals.Replication](https://www.nuget.org/packages/DSInternals.Replication/)\n- [DSInternals.SAM](https://www.nuget.org/packages/DSInternals.SAM/)\n\n### Building from Source Code\n\n[![Visual Studio 2026](https://img.shields.io/badge/Visual%20Studio-2026-383278.svg)](CONTRIBUTING.md#building-from-source-code)\n[![CI Build](https://github.com/MichaelGrafnetter/DSInternals/actions/workflows/autobuild.yml/badge.svg)](https://github.com/MichaelGrafnetter/DSInternals/actions/workflows/autobuild.yml)\n\nYou can of course download the [source code](https://github.com/MichaelGrafnetter/DSInternals/archive/master.zip),\nperform a review, and compile the Module/Framework yourself.\nSee the [CONTRIBUTING](CONTRIBUTING.md#building-from-source-code) guide for more info.\n\n## Documentation\n\n### Get-Help\n\nThe online version of [PowerShell Get-Help documentation](../Documentation/PowerShell/Readme.md#dsinternals-powershell-module) contains the list of all cmdlets and some usage examples.\n\n### Blog Posts\n\nI have also published a series of articles about the DSInternals module on [my blog](https://www.dsinternals.com/en/).\nHere are a few of them:\n\n- [Juicing ntds.dit Files to the Last Drop](https://specterops.io/blog/2025/08/14/juicing-ntds-dit-files-last-drop-dsinternals-powershell-active-directory-offline-attacks/)\n- [New Offline Capabilities in DSInternals 4.11](https://www.dsinternals.com/en/dsinternals-v4.11/)\n- [Cross-Forest Duplicate Password Discovery](https://www.dsinternals.com/en/cross-forest-duplicate-password-discovery/)\n- [CQLabs – Extracting Roamed Private Keys from Active Directory](https://cqureacademy.com/blog/extracting-roamed-private-keys)\n- [CQLabs – Offline Attacks on Active Directory](https://cqureacademy.com/cqure-labs/cqlabs-dsinternals-powershell-module)\n- [Auditing Active Directory Password Quality](https://www.dsinternals.com/en/auditing-active-directory-password-quality/)\n- [Dumping ntds.dit files](https://www.dsinternals.com/en/dumping-ntds-dit-files-using-powershell/)\n- [Retrieving Active Directory Passwords Remotely](https://www.dsinternals.com/en/retrieving-active-directory-passwords-remotely/)\n- [Retrieving DPAPI Backup Keys from Active Directory](https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/)\n- [Retrieving Cleartext GMSA Passwords from Active Directory](https://www.dsinternals.com/en/retrieving-cleartext-gmsa-passwords-from-active-directory/)\n- [Peeking into the Active Directory Database](https://www.dsinternals.com/en/peeking-into-the-active-directory-database/)\n- [Dumping and modifying Active Directory database using a bootable flash drive](https://www.dsinternals.com/en/dumping-modifying-active-directory-database-bootable-flash-drive/)\n- [Impersonating Office 365 Users With Mimikatz](https://www.dsinternals.com/en/impersonating-office-365-users-mimikatz/)\n\n### Slide Decks\n\n- [Black Hat Europe 2019: DSInternals PowerShell Module](https://www.dsinternals.com/wp-content/uploads/eu-19-Grafnetter-DSInternals-PowerShell-Module.pdf)\n- [Black Hat Europe 2019: Exploiting Windows Hello for Business](https://www.dsinternals.com/wp-content/uploads/eu-19-Grafnetter-Exploiting-Windows-Hello-for-Business.pdf)\n- [HipConf New York 2018: Offline Attacks on Active Directory](https://www.dsinternals.com/wp-content/uploads/HIP_AD_Offline_Attacks.pdf)\n\n## Acknowledgements\n\nThis project utilizes the following 3\u003csup\u003erd\u003c/sup\u003e party copyrighted material:\n\n- [ManagedEsent](https://github.com/Microsoft/ManagedEsent) - Provides managed access to esent.dll, the embeddable database engine native to Windows.\n- [PBKDF2.NET](https://github.com/therealmagicmike/PBKDF2.NET) - Provides PBKDF2 for .NET Framework.\n- [Bouncy Castle](https://www.bouncycastle.org/csharp/index.html) - A lightweight cryptography API for Java and C#.\n\n## Related Projects\n\n- [Mimikatz](https://github.com/gentilkiwi/mimikatz) - The No.1 tool for pass-the-hash attacks. Can use the credentials extracted by the DSInternals module to do some nasty stuff.\n- [NTDSXtract](https://github.com/csababarta/ntdsxtract) - A framework for ntds.dit parsing written in Python.\n- [Impacket](https://github.com/SecureAuthCorp/impacket) - Various MSRPC-based protocols implemented in Python.\n- [DIT Explorer](https://github.com/trustedsec/DitExplorer) - A graphical inspection tool for Active Directory databases.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmichaelgrafnetter%2Fdsinternals","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmichaelgrafnetter%2Fdsinternals","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmichaelgrafnetter%2Fdsinternals/lists"}