Harvesting tickets from Windows

Tickets in Windows are managed and stored by the lsass (Local Security Authority Subsystem Service) process, responsible for handling security policies. A non-administrative user can usually only access their own logon session, while an administrator (or SYSTEM) can enumerate and extract tickets across the host. On modern Windows builds, LSA Protection and Credential Guard frequently make old “just dump LSASS” tradecraft less reliable, so combine quick native triage, targeted dumping, and offline parsing instead of assuming a single command will always return every ticket.^[3]

Native triage

Before exporting anything, confirm whether the current session already has useful Kerberos material and whether you need elevation to reach other logon sessions:

klist
klist tgt
klist sessions

klist doesn’t export tickets, but it quickly confirms whether the current logon session already has a TGT, which service tickets are cached, and whether it is worth escalating before touching LSASS.^[1]

Mimikatz

Mimikatz is still the fastest option when you can read LSASS, and it is also useful against an offline LSASS minidump.^[1]

# Live LSASS access
privilege::debug
sekurlsa::tickets /export
sekurlsa::ekeys

# Parse an offline dump instead of reading lsass.exe again
sekurlsa::minidump C:\Temp\lsass.dmp
sekurlsa::tickets /export

sekurlsa::ekeys is especially useful in modern AES-first domains because it returns Kerberos key material you can reuse in over-pass-the-hash / pass-the-key workflows even when full ticket extraction is inconvenient.

Rubeus

Rubeus is usually the best first choice because it lets you triage before dumping and can work without elevation for some actions.^[2]

# Quick recon first: list LUID, username, service and expiry
.\Rubeus.exe triage
.\Rubeus.exe logonsession

# Dump only the interesting tickets
.\Rubeus.exe dump /service:krbtgt /nowrap
.\Rubeus.exe dump /luid:0x3e7 /service:krbtgt /nowrap   # SYSTEM / machine-account context
.\Rubeus.exe dump /luid:0x3e4 /nowrap                   # NETWORK SERVICE
.\Rubeus.exe dump /luid:0x3e5 /nowrap                   # LOCAL SERVICE

As a rule of thumb, non-elevated triage/dump only see the current user’s logon session. Elevated execution lets you enumerate other users, service logons, and machine-account tickets across the host.

If you cannot open LSASS but you can execute as the victim user, tgtdeleg is the most useful fallback because it abuses the Kerberos delegation/GSS-API flow to recover the current user’s TGT without elevation:

.\Rubeus.exe tgtdeleg /nowrap
.\Rubeus.exe tgtdeleg /outfile:user_tgt.kirbi

For long-lived access on a workstation, Rubeus can also harvest tickets as they appear instead of doing one noisy one-shot dump:

.\Rubeus.exe monitor /filteruser:*admin* /interval:30 /nowrap
.\Rubeus.exe harvest /filteruser:svc_* /outdir:C:\ProgramData\tickets

If you want to inject a stolen TGT without overwriting your current ticket cache, create a sacrificial logon session first and then use that LUID for ptt:

.\Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe
.\Rubeus.exe ptt /ticket:C:\Temp\admin.kirbi /luid:0xA1234

createnetonly prints the new LUID when it spawns the sacrificial session; inject into that session to keep your original TGT untouched. Ticket injection/replay and cross-platform conversion are covered in Pass the Ticket.

Parsing LSASS dumps offline

When EDR or LSASS-as-PPL makes repeated live access too noisy, export a full-memory LSASS dump once and parse it off-host. pypykatz can extract .kirbi tickets from that dump directly:

pypykatz lsa minidump lsass.dmp -k tickets/

Modern Windows nuances

On recent Windows 11 / Server 2025 estates, LSASS protected process and Credential Guard make old live-LSASS ticket dumping much less predictable. In practice:^[3]

expect TGT extraction to fail first when Credential Guard is enabled, while service tickets may still be present/useful.
target specific LUIDs instead of bulk-dumping everything whenever possible.
fall back to tgtdeleg, offline minidump parsing, or sekurlsa::ekeys when live LSASS access is restricted.
if you need the protection internals and common bypass considerations, read Windows credentials protections.