```sh
- crackmapexec smb <ip> -u '' -p '' --users #powerfull
- nmap --script smb-enum* -p445 10.10.10.161 (More user might show up in cme)
- ldapsearch -H ldap://10.10.10.161 -x -b "DC=htb,DC=local" '(objectClass=user)' sAMAccountName
- rpcclient -U '' 10.10.10.161 #powerfull
		- queryusergroups <RID>
		- querygroup <Group RID>
		- queryuser <RID>
		
- GetADUsers.py -all active.htb/svc_tgs -dc-ip <ip>
# Need Password
```