https://www.splunk.com/blog/2013/08/05/monitoring-local-administrators-on-remote-windows-systems.html