Relay NTLM to LDAP to configure RBCD
When SMB signing is off and LDAP signing is not enforced, coerced auth relayed to LDAP writes delegation for you.
When SMB signing is off and LDAP signing is not enforced, coerced auth relayed to LDAP writes delegation for you.
HTTP certificate enrollment plus machine coercion turns any domain foothold into a DC certificate and DCSync.