GetUserSPNS

Queries target domain for SPNs that are running under a user account.

This is helpful because you can grab a service account's password krb5tgs hash and attempt to crack it offline.