An application is vulnerable to DLL preloading attack on Windows if it loads a DLL simply by it's name. Windows then goes on to search several folders and loads the first DLL with a matching name.
Given access to a non-administrative user account, is it possible to determine which DLLs a process/service loaded, would load etc.? Or which DLLs it tried to load but failed? This process/service should belong to another user.