Identify the accounts most vulnerable to dictionary attacks

Having the NTLM and a cracked LM hash it is possible to get the original password by testing all the combinations of upper and lowercases. This is useful if a ntds.dit file has both NTLM and LM hashes

Active Directory Post Exploitation

abcdesktop API services

Script to crack the SAM file --- NTLM hash comparison