How to export the Hash list of the domain controller over the Intranet

Because the domain controller is usually strictly set, when running commands using similar remote execution tools, it will often fail and prompt errors similar to not write memory, we need to use other methods to obtain the Hash.

1. Use parallel xec and similar remote execution tools to directly capture remote hash 2. copy C: WINDOWSepair
3. regedit \ ip/e d: aa. reg/S "HKEY_LOCAL_MACHINESAMSAMDomainsAccountUsers"
 
4. Use the built-in Gui interface of windows to remotely operate the registry.
5. Remote Management Tools
DameWare Mini Remote Control