Impacket lookupsid.py

lookupsid.py <domain>/<user>:'<pass>'@<dc-ip>

Brute-force SIDs (RIDs) to enumerate domain users and groups.

When you cannot perform LDAP queries due to firewall restrictions, or when you want to obtain the RIDs of all objects. lookupsid.py performs RPC queries over SMB to list SIDs, which can reveal users and groups.

If the DC blocks anonymous RPC queries or if you do not have credentials. Also if the firewall blocks port 445.