NHS Offensive Cyber Range: Armsdon Hospital

Hi ofield​! 

You are on the right track, but the order matters. The intranet credentials are not intended to work directly against the domain controller. If RDP is available, focus first on the non DC system where that access makes sense.

If logins are failing, double-check the context rather than the technique. Confirm the correct host, domain, and username format. The intended flow is initial access on a non DC host, followed by local privilege escalation, and only then pivoting back to the domain.

You are very close. I am not able to offer exact steps or commands, but a small shift in approach should.