Event ID 4737
A security-enabled global group was changedA security-enabled global group was changed. Subject: Security ID: %4 Account Name: %5 Account Domain: %6 Logon ID: %7 Group: Security ID: %3 Group Name: %1 Group Domain: %2 Changed Attributes: SAM Account Name: %9 SID History: %10 Additional Information: Privileges: %8
Name | Field | Insertion String | OS | Example | ||
---|---|---|---|---|---|---|
Group Name | TargetUserName | %1 | Any | Read-only Domain Controllers | ||
Group Domain | TargetDomainName | %2 | Any | DOMAIN | ||
Security ID | TargetSid | %3 | Any | S-1-5-21-345695894-305466303-1622526952-521 | ||
Security ID | SubjectUserSid | %4 | Any | S-1-5-7 | ||
Account Name | SubjectUserName | %5 | Any | ANONYMOUS LOGON | ||
Account Domain | SubjectDomainName | %6 | Any | NT AUTHORITY | ||
Logon ID | SubjectLogonId | %7 | Any | 0x3e6 | ||
Privileges | PrivilegeList | %8 | Any | View Codes | ||
SAM Account Name | SamAccountName | %9 | Any | - | ||
SID History | SidHistory | %10 | Any | - |
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Security Group Management"
LEFT/RIGHT arrow keys for navigation
Back to List