Impacket's GetNPUsers.py can enumerate enabled Active Directory user accounts with UF_DONT_REQUIRE_PREAUTH over authenticated LDAP, or test supplied usernames directly with Kerberos AS-REQs. For accounts without Kerberos preauthentication, it returns encrypted AS-REP data in John/hashcat format for offline password cracking; it does not crack the data or recover a plaintext password itself.
Python
RESTRICTED_ACCESS_BLUR_MARKER