I like to use schtasks with the run as system option because basically any account can schedule tasks. If you can get you exe over to the box you can dump memory and use mimikatz to get the cleartext password. Once you have some good credentials you can psexec around the network.