Group Membership Modification via GenericAll

Use direct rights over an Active Directory group's member attribute to add the authenticated controlled account to a privileged group. GenericAll or WriteProperty on member can authorize this change; the Self-Membership validated write permits only adding or removing the caller's own account. WriteDACL or WriteOwner alone requires a separate ACL or ownership action that is outside this procedure. The new membership is available to newly authenticated sessions or tickets, not existing access tokens.