AS-REP roasting
Accounts with Kerberos pre-authentication disabled hand out a packet encrypted with their password to anyone who asks. No login required.
Pre-authentication exists precisely so that a requester must prove knowledge of the password before the server sends anything encrypted. With the DONT_REQ_PREAUTH flag set — usually because some elderly application couldn't cope otherwise — the domain controller sends an AS-REP anyway, part of which is encrypted under the account's key. The attacker needs nothing but a username, collects the response and feeds it to hashcat in mode 18200. The difference from Kerberoasting is that the latter requires a valid ticket, meaning a foothold in the domain; here it is enough to reach the domain controller over the network. Audit the directory for the flag and force long passwords on the accounts you cannot fix.