It would require read permissions access to the entire file system on every computer in the environment (so, likely a local administrator - and a domain administrator to read the whole file system on Domain Controllers); though a standard user may be able to read permissions on most (if not all) of AD itself.
This doesn't even take into account what access you would need to read and interpret permissions on any databases, web applications and other services in the environment.
The thing is, there is no real practical method to determine what access each principal has to everything in an environment - aside from a detailed, methodical, documentation process when initially configuring access. That is, leveraging numerous groups unique to each application, resource, and service that are noted with the precise access that each group confers. Of course, this all has to be planned and implemented before attempting to gather this information.
But if you're just looking for windows file system permissions, user righs assignments, and AD access, a domain admin combined with a local admin on all computers (assuming you're following best practices and domain admins do NOT have access to member servers and workstations).