Anyone know in what *file* encrypted passwords / password hashes are stored on a win2k domain controller? They're supposed to be in the active directory, but the AD is broken up into a bunch of files, kind of like the registry is.

OK, it's in ntds.dit, which is a glorified jet database like Access or Exchange uses called "Extensible Storage Engine." Win2k resource kit will provide some more answers, I hope. Wotsit's site is down right now; anyone know where to get file format for ESE files?