A computer account was promoted to a domain controller via a User Account Control (UAC) change
An attacker may attempt to gain domain administrator privileges.
Verify if the domain controller promotion is expected. Check if the computer account is a new account. Confirm this action with the user who performed the change. Follow actions by the account and if it performed a DCSync.