Impacket ticketer (golden ticket)

ticketer.py -nthash <krbtgt-hash> -domain-sid <sid> -domain <domain> administrator

Creates a Golden Ticket (TGT) with the krbtgt hash to gain unrestricted domain access.

When you have obtained the NTLM hash of krbtgt (via DCSync). The Golden Ticket allows you to authenticate as any user in the domain (including Administrator) without needing credentials.

If the domain changes the krbtgt password (every 30-60 days in secure environments), the Golden Ticket expires. Also not if the EDR monitors Kerberos ticket creation.