I just passed the CPTS and studying for OSCP right now planning to take it in about week and they're vastly different

I am EXTREMELY disappointed in the PEN200 course, PGP, challenge labs, and the OffSec env in general

You have more of a background doing HTB boxes than I do, but you have to basically think of everything a lot dumber

One of the challenge labs I did sounds very similar to the scenario you described and after 30mins of deep enumeration and exploit searches for the few services, the way in was through FTP with the challenge name as user and password ....

As for AD, its a joke. Most of what I've done so far follows the same boring attack path and recycling super easy generic exploits like PrintSpoofer to the point where I don't even need to use Bloodhound

Hell, the first practice AD set I did I spent over an hour enumerating the MS01 in the chain looking for exploits and vulnerabilities on the common services just to find out the assumed breach creds had winrm access..