New Domain Admin Detected

Purpose

The purpose of this solution is to detect the user or group of users if its promoted to domain administrator on a Windows domain controller. This solution has to be executed against Infrastructure masters only

Associated Content

Content	Type	Function
cPval Excluded Domain Admin	Custom Field	Stores the usernames to exclude from generating the new domain admin detected ticket
cPVAL New Domain Admin Monitoring	Custom Field	Custom field to enable/disable the solution
New Domain Admin Detected	Script	Detects the user or group of users if its promoted to domain administrator on a Windows domain controller.
New Domain Admin Detected	Ticket Template	configures how a ConnectWise Manage ticket will be generated for New domain admin accounts
New Domain Admin Detected	Condition	Runs the New Domain Admin Detected automation every 04 hours on Infrastructure masters

Implementation

• Create the Custom Field : cPval Excluded Domain Admin using the implementation instruction provided in the document.
• Create the Custom Field : cPVAL New Domain Admin Monitoring using the implementation instruction provided in the document.
• Create the Script : New Domain Admin Detected using the implementation instruction provided in the document.
• Create the Ticket Template : New Domain Admin Detected using the implementation instruction provided in the document.
• Create the Condition : New Domain Admin Detected using the implementation instruction provided in the document.

Changelog

2025-10-24

• Initial version of the document