((CommandLine:localgroup\ * CommandLine:\ \/add*) OR (CommandLine:Add\-LocalGroupMember\ * CommandLine:\ \-Group\ *)) (CommandLine:Group\ Policy\ Creator\ Owners* OR CommandLine:Schema\ Admins*)