Read LAPS passwords with extended rights
Delegated read of the LAPS attribute lets you pull local admin passwords for every managed machine you can see.
Delegated read of the LAPS attribute lets you pull local admin passwords for every managed machine you can see.
Any principal granted DS-Replication-Get-Changes rights can pull every hash in the domain, including krbtgt.