Relay NTLM to LDAP to configure RBCD
When SMB signing is off and LDAP signing is not enforced, coerced auth relayed to LDAP writes delegation for you.
Tag: rbcd
Resource-based constrained delegation from a single GenericWrite
One writable computer object plus a controlled account lets you S4U your way to any user on that host.