Event ID 4745

A security-disabled local group was changed

A security-disabled local group was changed.

Subject:
    Security ID:    %4
    Account Name:   %5
    Account Domain: %6
    Logon ID:       %7

Group:
    Security ID:  %3
    Group Name:   %1
    Group Domain: %2

Changed Attributes:
    SAM Account Name: %9
    SID History:      %10

Additional Information:
    Privileges:       %8




NameFieldInsertion StringOSExample
Group NameTargetUserName%1Any Distribution Local Group New
Group DomainTargetDomainName%2Any DOMAIN
Security IDTargetSid%3Any S-1-5-21-1913345275-1711810662-261465553-1144
Security IDSubjectUserSid%4Any S-1-5-21-1913345275-1711810662-261465553-500
Account NameSubjectUserName%5Any Administrator
Account DomainSubjectDomainName%6Any DOMAIN
Logon IDSubjectLogonId%7Any 0x1d9153
PrivilegesPrivilegeList%8Any -
SAM Account NameSamAccountName%9Any Distribution Local Group New
SID HistorySidHistory%10Any -


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Distribution Group Management"



LEFT/RIGHT arrow keys for navigation

Back to List