ZEKASTRA

SecurityAccount management

4732 · A member was added to a security-enabled local group

Generated each time a member is added to a security-enabled local group, such as the built-in Administrators group. Each added member produces a separate event.

01Fields in the event

  • MemberName
  • MemberSid
  • TargetUserName
  • TargetDomainName
  • TargetSid
  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • PrivilegeList

02How to use it

Additions to local Administrators or Remote Desktop Users are common persistence steps. Use MemberSid rather than MemberName to identify the member.

03Caveats

Requires Audit Security Group Management. For local groups MemberName is usually "-" even when a domain account is added.

05Sources

  1. Microsoft Learn — 4732(S) A member was added to a security-enabled local group checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.