Event ID 4750

This event generates every time security-disabled (distribution) global group is changed.

Some changes do not invoke a 4750 event, for example, changes made using the Active Directory Users and Computers management console in Managed By tab in group account properties.

If you change the name of the group (SAM Account Name), you also get “4781: The name of an account was changed” if “Audit User Account Management” subcategory success auditing is enabled.

If you change the group type, you get a change event from the new group type auditing subcategory instead of 4750. If you need to monitor for group type changes, it is better to monitor for “4764: A group’s type was changed.” These events are generated for any group type when group type is changed. “Audit Security Group Management” subcategory success auditing must be enabled.

From 4750 event you can get information about changes of sAMAccountName and sIDHistory attributes or you will see that something changed, but will not be able to see what exactly changed.