Event ID 4747
A member was removed from a security-disabled local groupA member was removed from a security-disabled local group. Subject: Security ID: %6 Account Name: %7 Account Domain: %8 Logon ID: %9 Member: Security ID: %2 Account Name: %1 Group: Security ID: %5 Group Name: %3 Group Domain: %4 Additional Information: Privileges: %10
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Distribution Group Management"
LEFT/RIGHT arrow keys for navigation
Back to List