Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise