Mass Local Administrator Account Disabled Across Multiple Hosts in a Short Time Window
An attacker who controls a centralized execution channel (GPO, script, scheduled task, management tool) can disable the built-in Administrator account on many hosts within a short time.
Cortex XDR

