Active any hints

I confirm @Blastware comment, got Domain Admin by this way during a pentest on my office.