ntds_get_object_by_sam
Reads allowlisted offline NTDS metadata for an exact SAM account name, flagging deleted, recycled, or duplicate matches without decrypting credentials or requiring SYSTEM.
Instructions
Read allowlisted offline NTDS metadata for one exact SAM name. Retained deleted/recycled matches are flagged; duplicate matches are explicit. Does not decrypt credentials or require SYSTEM.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| fields | No | Allowlisted metadata projection. Credential attributes are not exposed. | |
| max_scan | No | Maximum datatable records examined. Caps or schema uncertainty prevent complete-result claims. | |
| domain_dn | No | Optional exact, case-insensitive domain DN scope. | |
| max_chars | No | ||
| ntds_path | Yes | ||
| diagnostic_limit | No | ||
| sam_account_name | Yes | Required exact case-insensitive SAM account selector; no wildcard or account-list mode. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| status | Yes | ||
| objects | Yes | ||
| returned | Yes | ||
| matched_count | Yes | ||
| scan_complete | No | ||
| database_clean | No | ||
| returned_chars | Yes | ||
| payload_clipped | Yes | ||
| schema_complete | No | ||
| results_complete | Yes | ||
| serialized_chars | Yes | ||
| match_count_exact | No |