Rubeus asreproast

Rubeus.exe asreproast /outfile:asrep_hashes.txt

Requests AS-REP tickets for accounts without Kerberos preauthentication and extracts hashes for offline cracking.

When you have a domain account on a Windows host and want to exploit accounts with 'Do not require Kerberos preauthentication' enabled. Common in legacy service accounts. Rubeus asreproast is more efficient than GetNPUsers because it uses the current session.

If the domain has few accounts without preauthentication (recommended for security). Also not if EDR detects Rubeus. In those cases, use GetNPUsers.py from Linux.