cd1zz pointed you to some very good directions; for a real world scenario I will add searching for shares and trying to access them - you will be amazed how many misconfigurations exist.
For ldap: after you enumerate the juicy stuff, you can try again a dictionary attack on the user names discovered, even if the account lock-out is in place you might get lucky and guess a password with a dictionary attack.

If you want to tinker with AD for free Microsoft have quite a few pre-configured VHDs for Microsoft Virtual Server. 

http://technet.microsoft.com/en-us/bb738372

I've used these in the past, mainly the Exchange servers for evaluation and testing. With the standalone 2008/2003 servers you can easily create an AD environment just by running the command DCPROMO from RUN. A simple wizard will configure AD on your server.

Steve.