ZEKASTRA

SecurityAccount management

4728 · A member was added to a security-enabled global group

Domain-only counterpart of 4732 for global groups. Microsoft documents it as identical to 4732 in fields and XML; only the group type differs.

01Fields in the event

  • MemberName
  • MemberSid
  • TargetUserName
  • TargetDomainName
  • TargetSid
  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • PrivilegeList

02How to use it

Watch additions to privileged domain groups such as Domain Admins. Identify the actor through SubjectLogonId and check when the new member first used its new rights.

03Caveats

Requires Audit Security Group Management. Generated only for domain groups. Microsoft documents this ID on the Audit Security Group Management page rather than on its own page.

05Sources

  1. Microsoft Learn — Audit Security Group Management checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.