ZEKASTRA

SecurityAccount management

4756 · A member was added to a security-enabled universal group

Domain-only counterpart of 4732 for universal groups (for example Enterprise Admins). Microsoft documents the same fields and XML as 4732.

01Fields in the event

  • MemberName
  • MemberSid
  • TargetUserName
  • TargetDomainName
  • TargetSid
  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • PrivilegeList

02How to use it

Treat additions to forest-wide privileged groups as high priority; trace the actor through SubjectLogonId and check replication to other domain controllers.

03Caveats

Requires Audit Security Group Management. Generated only for domain groups. Microsoft documents this ID on the Audit Security Group Management page rather than on its own page.

05Sources

  1. Microsoft Learn — Audit Security Group Management checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.