Purple Knight fails to run when using runas via cmd

[hackerlawyer]

Ran on an assessment from non domain joined machine by following your instructions and Purple Knight failed to run all security checks. Any insight? Thanks!

[passtheticket]

Hi,
Did you check that the net view \\unsafe.local\ command returned NETLOGON and SYSVOL? Did Purple Knight accept that you inserted domain name and start working? Is AV or EDR installed on the computer?
I successfully executed PK a few days ago.

[Chriskolezynski]

Thanks for responding! I was able to view the NETLOGON and SYSVOL shares. Purple Knight did start running and accepted the domain name. I am seeing use of EDR/AV on network especially when attempting dumping lsa and sam. However I was able to run snaffler using your instructions no problem. Thanks for that btw! Also able to run bloodhound on this network without anything stopping it so not sure its the AV or EDR that's the problem since those tools are pretty loud

[Chriskolezynski]

Just worked out of nowhere. Not even sure why this time lol
Thanks again for responding