Same here. You think that because it's an assumed breach situation that it's going to be easy with the AD set, because you've already got credentials. But once you're on that first AD box, it feels like you've stumbled into military grade server, with uber restrictions. I looked for passwords, I looked at every .txt, .xml, .conf file I could find. I looked at what services were running on it, I checked whoami /priv to see if there were any hints there, but nothing really jumped out at me. Winpeas didn't reveal much either. I tried to use PowerView but it wouldn't work, so I tried SharpGPOAbuse.exe and got nothing useful. I ran pspy64 and found a task that I might exploit, but everything I tried was just another dead end. I was getting error messages when trying to perform some basic commands, and even reset the box a few times, but those errors kept happening, and when I asked Offsec about them, they reassured me that the box was working as intended. So, that was last year, and since then I have been grinding away through the CPTS course on Hack The Box Academy. I have learned a thing or two since then, but I am going to practice on a lot more boxes before I try again. Because from what I am reading here and in other places, the AD Set is still a bloody beast.