grep -l "DMSA" ./machines (1)

Windows Server 2025 DC with MSSQL impersonation leading to credential extraction, password spray for WinRM access, and BadSuccessor dMSA privilege escalation to Domain Admin.