LACheck

LACheck supports LA access enumeration across domain-joined systems using WinRM, SMB, and WMI/RPC. To minimize noise and reduce the chance of triggering alerts on the DC, enumeration can exclude the DC using the /ldap:servers-exclude-dc option.

LA Perms

LACheck.exe "winrm /ldap:servers-exclude-dc /threads:10 /domain:<domain>"

Logged On Users

LACheck.exe 'winrm /ldap:servers-exclude-dc /logons /threads:10 /domain:dollarcorp.moneycorp.local'