Assumed-breach Active Directory starter lab. Enumeration with the standard AD toolkit, a foothold, and the road to Domain Admin — documented as a repeatable methodology.

The commands I reach for first on any Active Directory box — SMB, LDAP, Kerberos, BloodHound.