https://blog.it-kb.ru/2011/08/03/scom-2007-r2-audit-changes-domain-security-groups-as-domain-admins/