Perform a lsarlookupsids3 with a trust account, it uses netlogon as SSP (see [MS-NRPC] 3.3) (AES version) ยท GitHub

https://gist.github.com/ThePirateWhoSmellsOfSunflowers/cdf85b2c3b040f7c33b66d7001baf0ab