Password Spraying

We can use DomainPasswordSpray.ps1. We can do it from both Windows and Linux but we will use Windows. Run this after importing

Invoke-DomainPasswordSpray -Password Welcome1

We get 2 hits, but these accounts are of no use.

Misc Techniques

Let's try a few more things to cover all our bases. We can search the SYSVOL share for Registry.xml files that may contain passwords for users configured with autologon via Group Policy.

Nothing there

We can search for passwords in user Description fields in AD, which is not overly common, but we still see it from time to time.

Get-DomainUser * |select samaccountname,description | ?{$_.Description -ne $null}