I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test).
Since the account is a service account, it cannot be used to log into the machine interactively using, e.g. Remote Desktop.
Given that I have the username/password of the privileged service account, and that I have the local administrator privileges on the machine, how can I run commands as the service account against the domain controller to add a new user etc.?