A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
That one command just gave you three domain users. No fancy exploit. No zero-day. Just Welcome1 against a list of 56 validated usernames. The output shows avazquez, tjohnson, and sgage all fell for it. Three accounts, one password, four seconds of execution time.
The grep for + filters out the hundreds of STATUS_LOGON_FAILURE lines and shows only successful authentications. Always validate hits immediately with a targeted command to confirm the credentials work and check the user's group membership.
The --local-auth flag is CRITICAL here. Without it, CrackMapExec authenticates using the domain context, which means failed attempts increment the domain account lockout counter. With --local-auth, it only attempts one login per machine against the local SAM. Never spray the built-in Administrator hash across a subnet without this flag unless you enjoy writing incident reports.
Local admin password reuse is absurdly common. Gold images deployed via SCCM or Intune often bake the same local admin password into every workstation. One NT hash from a single compromised machine can give you SYSTEM on dozens of hosts. Check high-value targets first: SQL servers, Exchange servers, jump hosts.
You have multiple sets of credentials now. Some are standard users. Some might be local admins on specific hosts. The next phase is where the real damage happens: credentialed enumeration of the entire domain structure. BloodHound, PowerView, CME. The full arsenal.
Finish the lesson once you have worked through the material. This awards ★ 40 XP.