From an account member of the group Backup Operators to Domain Admin without RDP or WinRM on the Domain Controller - View it on GitHub