What does the ARO: New Administrative Account Detected mean?

Introduction

Admin accounts have greater access to an endpoint and can alter its configuration and affect the services running upon it.

Field Effect alerts you when someone creates a new Admin account so you're aware of it and can take action if it's unexpected.

Windows Event Log entries that show someone adding users to a security-enabled group, either local or global, trigger this ARO.