Which AD permission is required to allow impersonation of an account?
Solution 1:
You're looking for:
"Impersonate a client after authentication" in the Local Security Policy under Local Policies -> User Rights Assignment
You can also use NTRights with "SeImpersonatePrivilege"
ntrights.exe +r SeImpersonatePrivilege -u domain\user