PowerView Get-NetUser

Get-NetUser -SPN | select samaccountname,serviceprincipalname

Enumerate AD users with specific attributes (SPN, admincount, etc.) to prepare attacks.

After foothold, to identify service accounts with SPN (Kerberoast), accounts with privileges (adminCount=1), or users with descriptions containing passwords. It's one of the first things I do in a domain.

If you have access to BloodHound, you don't need to enumerate manually. Also, if the domain is very large and enumerating all users is slow, filter by attributes.