Ntds.dit is the main Active Directory database file on a Windows domain controller. It stores directory objects such as user and group accounts, password hashes, Kerberos-related data, and other identity information that the domain relies on for authentication and access control.
In cyber security, Ntds.dit matters because copying it off a domain controller can expose highly sensitive credential material for offline analysis. Attackers often pair it with the SYSTEM registry hive, which can contain the keys needed to decrypt protected parts of the database. This combination is a classic credential-dumping target and is tracked by MITRE ATT&CK as NTDS dumping. Defenders protect against it by restricting access to domain controllers, hardening backup and snapshot systems, monitoring for suspicious file exports, and treating domain controller state as Tier 0 data.