RPC

Connect to client with anonymous account:

rpcclient -U "" -N <IP>

Useful commands:

rpcclient> enumdomusers
rpcclient> enumdomgroups