Impacker

GetADUsers.py -all -dc-ip X.X.X.X domain/username

psexec.py domain/user@x.x.x.x

GetUserSPNs.py -request -dc-ip x.x.x.x domain/user (to check kerberos tickets) after this hashcat results