ntdsutil

Use at your own risk. The tool does not require launching on a DC!
This will dump the Active Directory table in tsv format, from an offline
NTDS.dit file. This contains an ESENT (Extensible Storage Engine) database.
Clean ways to grab this file are ntdsutil (2008 or later), vssadmin (win2k3 or later) or ntbackup (win2k).
Ntdsutil is the best option, with the NTDS writer for VSS. It ensures a clean applicative shutdown of the database. Raw imaging with VSS only recovers ESENT consistency.

Open an admin cmd. Then:

1st option:
ntdsutil
activate instance NTDS
snapshot
create
list all
mount <n°>
copy C:\$SNAP_.....\Windows\NTDS\ntds.dit .

2nd option:
"vssadmin create shadow /for=C:"
then copy .dit, .log, .chk, .edb and .jrs files from snapshot path
finally commit the logged operations to get a clean base:
"esentutl /r edb /d /i /8"

Some interesting column numbers, not necessary to use the tool:
"MSysObjects" contains the metadata, "datatable" is the actual AD table, "sd_table" contains the security descriptors
"ATTm3" is the Common-Name
"ATTm11" is the Organizational-Unit-Name
"ATTm1376281" is the Domain-Component
"ATTm131532" is the LDAP-Display-Name (of attributes)
"ATTm590480" is the User-Principal-Name
"ATTc131102" is the Attribute-ID (columns) column
"ATTj591540" is the msDS-IntId column, for specific attribute ids (exchange...)
"ATTk590689" is the Pek-List
"ATTm590045" is the usernames column,
"ATTk589879" is the DBCS-Pwd column, encrypted LMHash,
"ATTk589914" is the Unicode-Pwd column, encrypted NTHash,
"ATTr589970" is the Object-Sid column (last int32 of the struct is the RID)
"ATTr590433" is the Sid-History column
"ATTj589832" is the User-Account-Control column
"ATTr589949" is the Supplemental-Credentials column (storing the reversible encrypted passwords)
"ATTb590606" is the Object-Category column (for a given object)
"ATTb590607" is the Default-Object-Category column (index of an object category schema attribute)
"ATTp131353" is the NT-Security-Descriptor (in fact an index, big endian, to sd_id from sd_table)
"ATTk589972" is the Schema-ID-GUID (found in ACE InheritedObjectTypes)
"ATTm590164" is the Rights-Guid (found in ACE ObjectTypes)
"Ancestors_col" is the multi-valued int32 DN ancestors
Exchange ms-Exch-Mailbox-Security-Descriptor: it depends.
Look for it either in Attribute-ID or in msDS-IntId