DNSAdmins to Domain Controller via server-level DLL

Membership in DNSAdmins can load an arbitrary DLL into the DNS service, which runs as SYSTEM on the DC.