LSASS is a System level process, so any kind of access to it will require Admin level privileges. I would guess that your user had admin access and you didn't realize it. You can [check your level of access through a batch script][1] to confirm. If you still have access to the machine you RDP'ed in to. To the best of my knowledge LSASS has always been a protected process. It's needed for user login to for distributing access tokens so it definitely wouldn't be a user level process. [1]: https://stackoverflow.com/questions/4051883/batch-script-how-to-check-for-admin-rights