Password Policy

rpcclient -U "" $IP -N
getdompwinfo

Password Spraying

nxc smb $IP -u users.txt -p passwords.txt