Forest

HINTS

User
System allows anonymous enumeration
Looks for weak Kerberos settings

Root
“Sniff” out DACL weakness
Use impacket to expose secrets