Event ID 4744

A security-disabled local group was created

A security-disabled local group was created.

Subject:
    Security ID:    %4
    Account Name:   %5
    Account Domain: %6
    Logon ID:       %7

New Group:
    Security ID:  %3
    Group Name:   %1
    Group Domain: %2

Attributes:
    SAM Account Name: %9
    SID History:      %10

Additional Information:
    Privileges:       %8




NameFieldInsertion StringOSExample
Group NameTargetUserName%1Any Distribution Domain local
Group DomainTargetDomainName%2Any HQCORP
Security IDTargetSid%3Any S-1-5-21-1913345275-1711810662-261465553-1136
Security IDSubjectUserSid%4Any S-1-5-21-1913345275-1711810662-261465553-500
Account NameSubjectUserName%5Any Administrator
Account DomainSubjectDomainName%6Any HQCORP
Logon IDSubjectLogonId%7Any 0x1d9153
PrivilegesPrivilegeList%8Any -
SAM Account NameSamAccountName%9Any Distribution Domain local
SID HistorySidHistory%10Any -


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Distribution Group Management"



LEFT/RIGHT arrow keys for navigation

Back to List