This link is worth looking at:
https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
To add on what @ShreKy said:
Active Directory
DNS - Zone Transfers
SMB
Kerberoasting (part of Active Directory) using impacket
Registry (see link above)
Powershell will do you good