Domain reconnaissance occurs after compromising a domain-joined machine.

High integrity not required

It is not necessary (and oftentimes undesirable) to perform recon wth high integrity token.

Common tools: