AD is based on the protocols x.500 and LDAP that came before it and still utilizes these protocols in some form today.

External Recon

Internal Recon

LLMNR/NBT-NS Poisoning - from Linux

LLMNR/NBT-NS Poisoning - from Windows

Enumerating & Retrieving Password Policies

Password Spraying - Making a Target User List

Internal Password Spraying

Enumerating Security Controls

Credentialed Enumeration - from Linux

Credentialed Enumeration - from Windows

Living off the Land

if you haven't checked out the WADComs project yet, you definitely should. It is an interactive cheat sheet for many of the tools we will cover (and more) in this module. It's hugely helpful when you can't remember exact command syntax or are trying out a tool for the first time

Kerberoasting

Kerberoasting - From Linux

Kerberoasting - from Windows