This is a whitepaper that discusses using DCSync to pull password hashes from a domain controller.
You can download it from the following link: https://packetstormsecurity.com/files/download/157113/ad-dcsync.pdf
Source: https://packetstormsecurity.com/files/157113/Active-Directory-DCSync.html