During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it is possible to access (non administrative) SMB shares as that user (assuming some exist), but is it possible to obtain a low level shell as that user? Or does obtaining a shell (via an NTLM hash or Kerberos ticket) always necessitate the user to be an administrator of whatever Windows machine you are targeting?
From some research, it seems you can weaken Windows security to allow PowerShell Remoting by non-administrative users but that seems like an unlikely scenario one would encounter. I am curious about things you can normally expect to be able to do (i.e. things that dont require stupid/unlikely configurations to work) with a TGT or NTLM hash when the user is not an administrative user on a workstation or server. Assume Windows 10/2012 or later.