DLL wrapping of meterpreter. Can be further improved to include dummy function depending on the DLL one wants to spoof . It can also be changed to support Windows hosted services .
Automation of winexe to bruteforce access to Windows RPC (IPC$ share) . Note that in case you have the correct admin credentials you might still not have access due to UAC remote restrictions.