title: Remotely add a domain user as admin when the impersonated user doesn't have domain access
body: <p>I'm writing a remote administration tool that can grant and revoke admin rights to users on other machines in the network.</p>
  <p>I have this configuration:</p>
  <ul>
  <li>A remote machine (machine1) with two administrative users:
  <ul>
  <li>A local admin: adminA</li>
  <li>A domain user with administrative rights: domA.com\adminB</li>
  </ul>
  </li>
  <li>A machine (machine2) running the admin tool, running user is not from the domA.com domain</li>
  <li>A domain user, domA\adminC which currently isn't an admin on machine1</li>
  </ul>
  <p>I wish to grant admin rights for the domA.com\adminC user, given the credentials to a local admin user on the remote machine.</p>
  <p>During the process, I can impersonate the <strong>local admin</strong> on the remote machine using the token from  advapi32.dll <code>LogonUser</code> method. In the impersonated context I'm able to use <code>DirectoryEntry</code> to find the remote machine's administrator group (using Sid). From there I can <code>Invoke</code> the <code>Add</code>/<code>Remove</code> action to add or remove the <strong>domain</strong> user using the path <code>WinNT://domA.com/adminC</code>.</p>
  <p>Again - this works with an impersonated <strong>local admin</strong> on the remote machine, <strong>not a domA.com user</strong>.</p>
  <p>If, however, I want to use <code>PrincipalContext</code>, <code>GroupPrincipal</code> and <code>UserPrincipal</code> to query this domain user permissions, add or remove it from the remote admin group - I'm unable to do so: I cannot start a <code>Domain</code> PrincipalContext without a domain user, as I'm using the local user, so I cannot get its <code>UserPrincipal</code> to add the admin <code>GroupPrincipal</code>.<br />
  This is inline with the Windows behavior - if I log on via RDP to the remote machine with the local admin, and attempt to add a domain account to its admin group, I need to provide domain credentials.</p>
  <p>Is there a way to use PrincipalContext to add a domain user without specifying a domain user's credentials, the way that DirectoryEntry allows?</p>