request TGS tickets for SPN accounts offline and crack them — no elevated privileges required.

authenticate as a user using only their NTLM hash — no plaintext password needed.