Adding to the enterprise admins group

I have heard that it is possible to add a user to the enterprise admins group through the “AT” command from the domain admin account of a subsiduary rather than the root domain. Can anyone give the details on how to do this, and any ideas on how stop it?

I’ve tried this using a ldifde command but this doesn’t work even from the domain admin’s account.