https://macmule.com/2015/11/06/ad-users-losing-admin-rights-when-off-the-domain/