@nygl @futzle @cyberlyra So true. We just had a pen-test and they used a fake DC to gather quite a few hashes before we detected it (from 2 non-MS systems, naturally).

@nygl @futzle And (silly me) I did not check the other replies before I replied. I see that @cyberlyra has a helpful listing of solutions/resources. Very cool.
Thankfully, I'm about to retire from my I.T. job... I am sooooo looking forward to never logging into anything with Micro$oft splattered all over it.

@nygl Not what you asked for, but OSALT suggests open source alternatives for almost everything. Here's the example for AD:
https://www.osalt.com/active-directory#google_vignette
On my initial pondering about your query, I think a how-to doc would be tricky since each infrastructure is so different.
cc @futzle