“Sure, you have compromised the whole Windows domain, but from an internal workstation. The attacker does not have this workstation.”