[opensourcedex]

DSInternals is a free, open source threat detection & response project written in C# and released under MIT. It has 1,969 GitHub stars, 277 forks and 20 open issues, and was last pushed 13 days ago. On this registry it ranks #25 of 29 tracked projects in Threat Detection & Response, with 5 head-to-head comparisons available.

What is DSInternals?

DSInternals is an MIT-licensed C# framework and PowerShell module that exposes internal Active Directory features — password auditing, DPAPI-NG and key credential handling, offline ntds.dit manipulation, and bare-metal domain controller recovery — to Active Directory administrators, security teams, and penetration testers.

What it is

The DSInternals project consists of two parts. The DSInternals Framework is published as NuGet packages and exposes several internal features of Active Directory for use from any .NET application; its codebase has already been integrated into third-party commercial products. The DSInternals PowerShell Module is published on the PowerShell Gallery and provides easy-to-use cmdlets built on top of that framework. The codebase is written in C# under the MIT licence, supports PowerShell 5.1 and 7, .NET Framework 4.8+ and .NET 8.0+, runs on x64, x86, and ARM64, and targets Windows Server 2008 R2 through 2025.

It lives in the Active Directory and Windows Server ecosystem, where it fills the gap left by standard directory tooling that does not expose the internals of the service. DSInternals works directly against the Active Directory database — ntds.dit — and against the live directory over LDAP, rather than only through the ordinary administration interfaces. That means hash dumping with Get-ADDBAccount, password resets with Set-ADDBAccountPassword, group membership changes with Set-ADDBPrimaryGroup, trust password extraction with Get-ADDBTrust, LAPS password decryption, and BitLocker recovery key extraction with Get-ADDBBitLockerRecoveryInformation can all be performed on an offline copy of the database. The same approach lets an administrator read AD-integrated DNS zones and resource records from either source, and rebuild a domain controller from nothing more than IFM backups.

Key capabilities

  • Active Directory password auditing through Test-PasswordQuality, which discovers accounts sharing the same password or holding passwords found in a public database such as HaveIBeenPwned or in a custom dictionary.
  • DPAPI-NG data protection and decryption with Protect-DpapiNgData, named protection descriptor management with New-DpapiNgNamedDescriptor, decryption of SID-protected PFX certificates with Unprotect-DpapiNgPfxCertificate, and offline unlock of BitLocker SID-based key protectors with Save-DpapiNgSidKey by deriving DPAPI-NG group keys from KDS root keys.
  • Key credential auditing and generation with Get-ADKeyCredential, covering NGC, FIDO2, and STK keys and testing keys against the ROCA vulnerability; new NGC keys can be registered through the MS-DRSR protocol with Add-ADReplNgcKey.
  • Bare-metal recovery of domain controllers from IFM backups alone — ntds.dit plus SYSVOL — using New-ADDBRestoreFromMediaScript.
  • Offline ntds.dit manipulation covering hash dumping, password resets, primary group changes, trust password extraction, Golden gMSA and dMSA attacks through Get-ADDBServiceAccount, account enabling and disabling, LAPS password decryption, and BitLocker recovery key extraction.
  • Active Directory-integrated DNS zone and resource record reading from ntds.dit with Get-ADDBDnsServerZone and from the live directory over LDAP.

Who uses it and how

  • Third-party commercial products embed the Framework in scenarios such as Active Directory disaster recovery, identity management, cross-forest migrations, and password strength auditing.
  • Security teams run password audits to find shared credentials and passwords present in public breach data or a custom dictionary.
  • Penetration testers analyse offline copies of ntds.dit, extracting hashes, trust passwords, service account material, and BitLocker recovery information.
  • Administrators recover domain controllers from IFM backups containing ntds.dit and SYSVOL without a full system-state restore.
  • The module is driven interactively from PowerShell 5.1 or 7 across Windows Server 2008 R2 through 2025, on x64, x86, and ARM64 hosts.

Getting started

The PowerShell Module is installed from the PowerShell Gallery under the package name DSInternals, while the Framework is consumed as NuGet packages from the DSInternals profile on nuget.org. The project homepage is https://www.dsinternals.com.

How it compares

The supplied facts provide no list of paid products that DSInternals replaces, and they name no similar tools. It therefore stands alone in this registry, sitting in the Security & Privacy / Threat Detection & Response category as a self-hosted, MIT-licensed framework and module rather than a commercial offering.

When to use it — and when not to

DSInternals is a PowerShell module and a .NET library, not a managed service, and it is Windows-centric: the supported platforms are Windows Server 2008 R2 through 2025 with PowerShell 5.1 or 7 and .NET Framework 4.8+ or .NET 8.0+, so teams working in non-Windows environments or wanting a hosted, agent-based monitoring product should look elsewhere. Several operations require an offline copy of ntds.dit and, for recovery, the accompanying SYSVOL from IFM media, so the tool is only useful where an administrator can lawfully obtain and handle those artefacts and holds the elevated access they demand. The facts describe no graphical interface, so anyone who needs to work outside a command line is not the intended user.

project readme (upstream, from github) — read inline

DSInternals Logo DSInternals Logo

Directory Services Internals
PowerShell Module and Framework

MIT License PowerShell 5.1 | 7 Windows Server 2008 R2 | 2012 R2 | 2016 | 2019 | 2022 | 2025

.NET Framework 4.8+ .NET 8.0+ Architecture x64 | x86 | ARM64

Introduction

The DSInternals project consists of these two parts:

[!WARNING] Features exposed through these tools are not supported by Microsoft. Improper use might cause irreversible damage to domain controllers or negatively impact domain security.

Author

Michael Grafnetter

Twitter Blog LinkedIn

I have created these tools in my spare time and I am using them while performing AD security audits and also in my lectures to demonstrate how Active Directory works internally.

I would like to thank all people who have contributed to the project by sending their feedback or by submitting their code. In case you would also like to help with this project, please see the CONTRIBUTING document.

Downloads

PowerShell Gallery Downloads Chocolatey Downloads GitHub Downloads NuGet Gallery Downloads

PowerShell Gallery

You can install the DSInternals module directly from the official PowerShell Gallery by running the following command:

Install-Module DSInternals -Force

Additional steps might be required on some freshly installed computers before DSInternals can be downloaded:

# TLS 1.2 must be enabled on older versions of Windows.
[System.Net.ServicePointManager]::SecurityProtocol =
    [System.Net.ServicePointManager]::SecurityProtocol -bor [System.Net.SecurityProtocolType]::Tls12

# Download the NuGet package manager binary.
Install-PackageProvider -Name NuGet -Force

# Register the PowerShell Gallery as package repository if it is missing for any reason.
if($null -eq (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue)) {
    Register-PSRepository -Default
}

# Download the DSInternals PowerShell module.
Install-Module -Name DSInternals -Force

Chocolatey Package

The DSInternals PowerShell Module can also be installed using the official Chocolatey package by executing the following Chocolatey command:

choco install dsinternals-psmodule --confirm

This package is self-contained and it will also install all dependencies. Note that package versions prior to 3.5 were not official.

WAPT Package

The DSInternals PowerShell Module can also be installed using the WAPT package.

The package can be installed by the WAPT console or by the WAPT Command-line interface like so:

wapt-get install dsinternals

This package is self-contained and it will also install all dependencies.

Offline Module Distribution

  1. Download the current release from GitHub.
  2. Unblock the ZIP file, using either the Properties dialog or the Unblock-File cmdlet. If you fail to do so, all the extracted DLLs will inherit this attribute and PowerShell will refuse to load them.
  3. Extract the DSInternals directory to your PowerShell modules directory, e.g. C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DSInternals or C:\Users\John\Documents\WindowsPowerShell\Modules\DSInternals.
  4. (Optional) If you copied the module to a different directory than advised in the previous step, you have to manually import it using the Import-Module cmdlet.

Commando VM

The DSInternals PowerShell module is part of FireEye's Commando VM, the Windows-based alternative to Kali Linux.

NuGet Packages

The easiest way of integrating the DSInternals functionality into .NET applications is by using the DSInternals Framework NuGet packages:

Building from Source Code

Visual Studio 2026 CI Build

You can of course download the source code, perform a review, and compile the Module/Framework yourself. See the CONTRIBUTING guide for more info.

Documentation

Get-Help

The online version of PowerShell Get-Help documentation contains the list of all cmdlets and some usage examples.

Blog Posts

I have also published a series of articles about the DSInternals module on my blog. Here are a few of them:

Slide Decks

Acknowledgements

This project utilizes the following 3rd party copyrighted material:

  • ManagedEsent - Provides managed access to esent.dll, the embeddable database engine native to Windows.
  • PBKDF2.NET - Provides PBKDF2 for .NET Framework.
  • Bouncy Castle - A lightweight cryptography API for Java and C#.

Related Projects

  • Mimikatz - The No.1 tool for pass-the-hash attacks. Can use the credentials extracted by the DSInternals module to do some nasty stuff.
  • NTDSXtract - A framework for ntds.dit parsing written in Python.
  • Impacket - Various MSRPC-based protocols implemented in Python.
  • DIT Explorer - A graphical inspection tool for Active Directory databases.

Frequently asked questions

Is DSInternals free to use?

DSInternals is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does DSInternals do?

Directory Services Internals (DSInternals) PowerShell Module and Framework

What is DSInternals written in?

DSInternals is primarily written in C#. Its source is publicly available at https://github.com/MichaelGrafnetter/DSInternals, and it has 1,969 GitHub stars.