NetExec: Enumerate Logged-On Users with the Remote Registry Service
Session enumeration is only possible with admin privileges? That is a problem of the past thanks to the new --reg-sessions core functionality of NetExec. SID values are the registry hives from NTUSER.dat which are loaded/unloaded depending on the user being logged in or not.
Blog: Session Enumeration Through Remote Registry
Post #368
951