Using rpcclient

We can use enumerate password policies through smb null sessions

First connect to rpcclient

rpcclient -U "" -N 172.16.5.5

The run querydominfo to enumerate password policy

rpcclient $> querydominfo