https://github.com/PyroTek3/PowerShell-AD-Recon/blob/master/Find-PSServiceAccounts#L182 This line contains a return statement before the GetTGS actions are performed preventing any kerberos tickets from being retrieved.