Event ID 4752
A member was removed from a security-disabled global groupA member was removed from a security-disabled global group.
Subject:
Security ID: %6
Account Name: %7
Account Domain: %8
Logon ID: %9
Member:
Security ID: %2
Account Name: %1
Group:
Security ID: %5
Group Name: %3
Group Domain: %4
Additional Information:
Privileges: %10This event generates every time member was removed from the security-disabled (distribution) global group.
For every removed member you will get separate 4752 event.
Microsoft Documentation
| Name | Field | Insertion String | OS | Example | ||
|---|---|---|---|---|---|---|
| Account Name | MemberName | %1 | Any | CN=Auditor,CN=Users,DC=contoso,DC=local | ||
| Security ID | MemberSid | %2 | Any | S-1-5-21-3457937927-2839227994-823803824-2104 | ||
| Group Name | TargetUserName | %3 | Any | ServiceDeskSecond | ||
| Group Domain | TargetDomainName | %4 | Any | DOMAIN | ||
| Security ID | TargetSid | %5 | Any | S-1-5-21-3457937927-2839227994-823803824-6119 | ||
| Security ID | SubjectUserSidSubjectUserSid | %6 | Any | S-1-5-21-3457937927-2839227994-823803824-1104 | ||
| Account Name | SubjectUserName | %7 | Any | dadmin | ||
| Account Domain | SubjectDomainName | %8 | Any | DOMAIN | ||
| Logon ID | SubjectLogonId | %9 | Any | 0x3007b | ||
| Privileges | PrivilegeList | %10 | Any | View Codes | ||
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Distribution Group Management"
LEFT/RIGHT arrow keys for navigation
Back to List