Replace a process level token
Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
Determines which user accounts can initiate a process to replace the default token associated with a launched subprocess.
This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.
By default, only LocalSystem accounts have this privilege.