((EventID:30 (SearchFilter:\(groupType\:1.2.840.113556.1.4.803\:=2147483648\)* OR SearchFilter:\(groupType\:1.2.840.113556.1.4.803\:=2147483656\)* OR SearchFilter:\(groupType\:1.2.840.113556.1.4.803\:=2147483652\)* OR SearchFilter:\(groupType\:1.2.840.113556.1.4.803\:=2147483650\)* OR SearchFilter:\(sAMAccountType=805306369\)* OR SearchFilter:\(sAMAccountType=805306368\)* OR SearchFilter:\(sAMAccountType=536870913\)* OR SearchFilter:\(sAMAccountType=536870912\)* OR SearchFilter:\(sAMAccountType=268435457\)* OR SearchFilter:\(sAMAccountType=268435456\)* OR SearchFilter:\(objectCategory=groupPolicyContainer\)* OR SearchFilter:\(objectCategory=organizationalUnit\)* OR SearchFilter:\(objectCategory=nTDSDSA\)* OR SearchFilter:\(objectCategory=server\)* OR SearchFilter:\(objectCategory=domain\)* OR SearchFilter:\(objectCategory=person\)* OR SearchFilter:\(objectCategory=group\)* OR SearchFilter:\(objectCategory=user\)* OR SearchFilter:\(objectClass=trustedDomain\)* OR SearchFilter:\(objectClass=computer\)* OR SearchFilter:\(objectClass=server\)* OR SearchFilter:\(objectClass=group\)* OR SearchFilter:\(objectClass=user\)* OR SearchFilter:\(primaryGroupID=521\)* OR SearchFilter:\(primaryGroupID=516\)* OR SearchFilter:\(primaryGroupID=515\)* OR SearchFilter:\(primaryGroupID=512\)* OR SearchFilter:Domain\ Admins* OR SearchFilter:objectGUID=\** OR SearchFilter:\(schemaIDGUID=\*\)* OR SearchFilter:admincount=1*)) (-(EventID:30 (SearchFilter:\(domainSid=*\)* OR SearchFilter:\(objectSid=*\)*)))) OR (EventID:30 (SearchFilter:\(userAccountControl\:1.2.840.113556.1.4.803\:=4194304\)* OR SearchFilter:\(userAccountControl\:1.2.840.113556.1.4.803\:=2097152\)* OR SearchFilter:\!\(userAccountControl\:1.2.840.113556.1.4.803\:=1048574\)* OR SearchFilter:\(userAccountControl\:1.2.840.113556.1.4.803\:=524288\)* OR SearchFilter:\(userAccountControl\:1.2.840.113556.1.4.803\:=65536\)* OR SearchFilter:\(userAccountControl\:1.2.840.113556.1.4.803\:=8192\)* OR SearchFilter:\(userAccountControl\:1.2.840.113556.1.4.803\:=544\)* OR SearchFilter:\!\(UserAccountControl\:1.2.840.113556.1.4.803\:=2\)* OR SearchFilter:msDS\-AllowedToActOnBehalfOfOtherIdentity* OR SearchFilter:msDS\-AllowedToDelegateTo* OR SearchFilter:msDS\-GroupManagedServiceAccount* OR SearchFilter:\(accountExpires=9223372036854775807\)* OR SearchFilter:\(accountExpires=0\)* OR SearchFilter:\(adminCount=1\)* OR SearchFilter:ms\-MCS\-AdmPwd*)) OR (EventID:30 SearchFilter:\(objectclass=\*\) (DistinguishedName:CN=Domain\ Admins* OR DistinguishedName:CN=Enterprise\ Admins* OR DistinguishedName:CN=Group\ Policy\ Creator\ Owners*))