Members of "Schema Admins"

Schema Admins

Members can modify the Active Directory schema structure and can backdoor any to-be-created Group/GPO by adding a compromised account to the default object ACL.

Get-ADGroup -Identity "Schema Admins" -Properties *