LACheck

LACheck supports LA access enumeration across domain-joined systems using WinRM, SMB, and WMI/RPC. To minimize noise and reduce the chance of triggering alerts on the DC, enumeration can exclude the DC using the /ldap:servers-exclude-dc option.

LA Perms

LACheck.exe "winrm /ldap:servers-exclude-dc /threads:10 /domain:<domain>"

Logged On Users