((CommandLine:localgroup\ * CommandLine:\ \/add*) OR (CommandLine:Add\-LocalGroupMember\ * CommandLine:\ \-Group\ *)) (CommandLine:\ administrators\ * OR CommandLine:\ administrateur*)