Windows Admin Share

Pass - The - Hash

Security Event Log
4624	Logon Type 3
4672	Logon user Name\Logon by user with admin rights\
4776	NLTM - if auth from local system
4768	TGT granted
5140	share access