I would like to know what the minimum access is to be able to dump from the lsass process on a Windows machine (any version) to try and grab LSA Secrets.
The reason I am asking is because I had thought it was restricted to admin and higher, but accross multiple penetration tests and different versions of windows, I have in the past been able to obtain LSA Secrets without getting local admin first, sometimes while logged in via RDP.
Now, is this because my user had admin access and I didn't realize it? Is that the only possibility? Or are earlier versions of Windows less restricted in allowing access to LSA Secrets?