Part 2 of "Disabled Isn't Safe": how we took a hybrid onboarding script from Domain Admin and Global Administrator down to a standard user account, one step at a time