Rubeus tgtdeleg

Rubeus.exe tgtdeleg /nowrap

Gets the current session's TGT without credentials or SeDebugPrivilege, abusing Kerberos delegation (machine account signing).

When you're on a host as a domain user (or SYSTEM) and want a TGT for pass-the-ticket without needing local admin or touching lsass. It's the quietest way to steal a TGT on a domain-joined host.

If the host isn't domain-joined or the machine account can't delegate. Also if the target uses Credential Guard: the TGT will be protected and tgtdeleg will fail or deliver an unusable ticket.