Impacket GetNPUsers

GetNPUsers.py <domain>/ -dc-ip <dc-ip> -usersfile users.txt -format hashcat

Obtains AS-REP hashes for accounts without preauthentication in the domain from Linux.

When you don't have Windows access or want to avoid Rubeus. It's the alternative for ASREPRoast from Linux. Useful if you have a user list (users.txt) and want to test if any lack preauthentication.

If you don't have a user list, GetNPUsers.py can enumerate all domain users, but that generates more noise. In domains where all accounts have preauthentication, the command will return nothing.