HackTricks notes: "Combining SeMachineAccountPrivilege with any account that has SeBackupPrivilege or SeRestorePrivilege leads to full domain compromise."
Audit Event ID (A computer account was created). Look for: semachineaccountprivilege hacktricks