SeManageVolumePrivilege to "Full Admin" escalation:
1. Enable the privilege in the token
2. Create handle to \\.\C: with SYNCHRONIZE | FILE_TRAVERSE
3. Send the FSCTL_SD_GLOBAL_CHANGE to replace S-1-5-32-544 with S-1-5-32-545
4. Overwrite utilman.exe etc.
5. 😎