Broke out ntdsutil.exe from creation_of_shadow_copy to allow for better filtering and specific monitoring/alerting.
mhaag-spl