Shadow Credentials

Kerberoast

Kerberos Delegation

AddMenber on Group

LAPS (Local Administrator Password Solution)

group Managed Service Account (gMSA)

AD CS - Escalation

GenericAll On A User

WriteDacl - Winodows

GenericAll On A Group - Windows

ForceChangePassword

AD Recycle

PASSWORD MUST CHANGE

Backup Admins

GenericAll On A Machine

Abusing GPO

Keytab Files

WriteOwner - Group

GenericWrite - Group to User