Event ID 4729

A member was removed from a security-enabled global group

A member was removed from a security-enabled global group.

Subject:
    Security ID:        %6
    Account Name:       %7
    Account Domain:     %8
    Logon ID:           %9

Member:
    Security ID:        %2
    Account Name:       %1

Group:
    Security ID:        %5
    Group Name:         %3
    Group Domain:       %4

Additional Information:
    Privileges:         %10




NameFieldInsertion StringOSExample
Account NameMemberName%1Any -
Security IDMemberSid%2Any S-1-5-21-1913345275-1711810662-261465553-1002
Group NameTargetUserName%3Any None
Group DomainTargetDomainName%4Any 2018DC
Security IDTargetSid%5Any S-1-5-21-1913345275-1711810662-261465553-513
Security IDSubjectUserSid%6Any S-1-5-21-1913345275-1711810662-261465553-500
Account NameSubjectUserName%7Any Administrator
Account DomainSubjectDomainName%8Any 2018DC
Logon IDSubjectLogonId%9Any 0x471386
PrivilegesPrivilegeList%10Any -


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Security Group Management"



LEFT/RIGHT arrow keys for navigation

Back to List