Tealeaf's user management can be a little flakey. We run into issues all the time for users not seeing what their groups is allowed to see or odd behaviors. The ability for an admin to impersonate another user would help in troubleshooting these issues. It should be restricted to disallow impersonation of another admin to prevent "hiding" tracks.

Not sure if/how this could work for session access with NT authentication enabled but perhaps tracking of which groups the user was in previously might work.