NTDS.dit Exfiltration Enables Complete Active Directory Compromise