While nltest.exe is a Microsoft executable that runs natively on Windows Server 2003 - 2012, it is probably unlikely to see someone executing commands in your environment with this tool. Note that the SocGhoulish malware which is one of Red Canary's top malware in 2022, tries to enumerate AD with this (https://redcanary.com/threat-detection-report/threats/socgholish/). If you see activity, locate the administrator for that server and see if it is them.