Another large file issue

[lex-de-nuc]

Hi,
I'm trying to dump hashes from 4,5 GB NTDS.dit file, but I'm getting unhandled exception.
Attaching debug output:

NtdsAudit.exe "ntds.dit" -s "SYSTEM" -p pwdump.txt --history-hashes --debug
Called: NtdsAudit::EnumerateMSysObjects
  Found 3614 datatable column names
  Completed in 00:00:00.0648362
Called: NtdsAudit::EnumerateLinkTable
  Ignored 60617 deleted backlinks
  Found 1008200 backlinks
  Completed in 00:00:03.0116650
Called: NtdsAudit::EnumerateDatatableTableLdapDisplayNames
  Failed to match 1902 LDAP display names to datatable column names
  Matched 2186 LDAP display names to datatable column names
  Completed in 00:00:16.8508139
Called: NtdsAudit::EnumerateDatatableTable

Unhandled Exception: System.Collections.Generic.KeyNotFoundException: The given key was not present in the dictionary.
   at System.Collections.Generic.Dictionary`2.get_Item(TKey key)
   at System.Collections.ObjectModel.ReadOnlyDictionary`2.get_Item(TKey key)
   at NtdsAudit.NtdsAudit.EnumerateDatatableTable(JetDb db, IReadOnlyDictionary`2 ldapDisplayNameToDatatableColumnNameDictionary, Boolean dumpHashes,
Boolean includeHistoryHashes)
   at NtdsAudit.NtdsAudit..ctor(String ntdsPath, Boolean dumphashes, Boolean includeHistoryHashes, String systemHivePath, String wordlistPath)
   at NtdsAudit.Program.<>c__DisplayClass2_0.<Main>b__0()
   at Microsoft.Extensions.CommandLineUtils.CommandLineApplication.Execute(String[] args)
   at NtdsAudit.Program.Main(String[] args)

Can you please include additional error handling to your program, so I can get past it?

Thanks!

Lex de Nuc

[DManolis]

Hi, I have a similar issue? A 3.4 Gb file is not analyzed. A much smaller sample file, is fine.

It would be great if this can be fixed!!!

Thanks!

[mzsk588]

The tool return an error "Unhandled Exception: OutOfMemoryException." when you run on a large NTDS!