Detects activity as "net user administrator /domain" and "net group domain admins /domain"
Already have an account? Log in