I haven't precisely done what you're describing, but I would expect most online bruteforce and dictionary attacks to quickly run into account lockout thresholds.
One workaround for this is password spraying - trying just a few of the most common passwords against many accounts. Unless the environment's controls are tuned to detect such activity, you're likely to get at least a few valid credentials without detection - and by distributing such an attack across many protocols, you might be less likely to be detected!
But in practice, you'll almost always find this unnecessary -- because it's more efficient and reliable to exploit an unpatched system, steal credentials or hashes from that system, pass (or crack) the hashes, pivot to another system with higher-privileged credentials, and repeat until you acquire the target level of access.
Edit: I see now in your comments that the artificial lab environment that you're working with explicitly has no lockout thresholds (not usually a real-world scenario).
Of likely available protocols (including the ones that you've listed), I would expect DC-based LDAP to be the service most likely to be A) already tuned for high performance, and b) have direct access to the back-end authentication data (eliminating performance issues related to a secondary service that must then relay the authentication attempts to the back-end AD infrastructure).
I would expect a high-speed Hydra attack directly against AD LDAP, in parallel against all available DCs (including read-only DCs), to be the most likely way to even start to approach the saturation point of the aggregate back-end AD authentication capacity. Theoretically, to increase per-source throughput, you could distribute hydra to all available workstations and servers in the environment.