Event ID: 4729

A member was removed from a security-enabled global group

A member was removed from a security-enabled global group.

Subject:
    Security ID:        %6
    Account Name:       %7
    Account Domain:     %8
    Logon ID:           %9

Member:
    Security ID:        %2
    Account Name:       %1

Group:
    Security ID:        %5
    Group Name:         %3
    Group Domain:       %4

Additional Information:
    Privileges:         %10




Name Field Insertion String OS Example
Account Name MemberName %1 Any -
Security ID MemberSid %2 Any S-1-5-21-1913345275-1711810662-261465553-1002
Group Name TargetUserName %3 Any None
Group Domain TargetDomainName %4 Any 2018DC
Security ID TargetSid %5 Any S-1-5-21-1913345275-1711810662-261465553-513
Security ID SubjectUserSid %6 Any S-1-5-21-1913345275-1711810662-261465553-500
Account Name SubjectUserName %7 Any Administrator
Account Domain SubjectDomainName %8 Any 2018DC
Logon ID SubjectLogonId %9 Any 0x471386
Privileges PrivilegeList %10 Any -


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Security Group Management"



LEFT/RIGHT arrow keys for navigation

Back to List