If I try to run it only as admin on WinXP I get "[-] Post failed: Rex::Post::Meterpreter::RequestError priv_fs_get_file_mace: Operation failed: Access is denied." which apparently requires system privileges. If I run it as system it works just fine. Offset reads work with admin privs so it's just because of that one mace-time that the system privs are required. Win7 works just fine with only admin privs on both offset reads and mace-time read.

I guess I could go around that by adding a check so that if the user has only admin privs on WinXP it'd read the filetime inside the prefetch file(from that lastrun_offset) and convert that and forget the whole mace-time reads. My original plan was to use filetime only because mace times are easy to change but I decided against that since mace was easier to get and there's no need to do filetime->localtime time conversions & since this is not forensically sound method of accessing the information to begin with I figured the added value isn't really that much.