The script queries the Domain Controller for each user. If pre-auth is disabled, it returns an encrypted blob (the AS-REP).
Output:
Method using diskshadow + robocopy (in WinRM):
Method using diskshadow + robocopy (in WinRM): forest hackthebox walkthrough best