Event ID 4750
A security-disabled global group was changedA security-disabled global group was changed.
Subject:
Security ID: %4
Account Name: %5
Account Domain: %6
Logon ID: %7
Group:
Security ID: %3
Group Name: %1
Group Domain: %2
Changed Attributes:
SAM Account Name: %9
SID History: %10
Additional Information:
Privileges: %8This event generates every time security-disabled (distribution) global group is changed.
Some changes do not invoke a 4750 event, for example, changes made using the Active Directory Users and Computers management console in Managed By tab in group account properties.
If you change the name of the group (SAM Account Name), you also get “4781: The name of an account was changed” if “Audit User Account Management” subcategory success auditing is enabled.
If you change the group type, you get a change event from the new group type auditing subcategory instead of 4750. If you need to monitor for group type changes, it is better to monitor for “4764: A group’s type was changed.” These events are generated for any group type when group type is changed. “Audit Security Group Management” subcategory success auditing must be enabled.
From 4750 event you can get information about changes of sAMAccountName and sIDHistory attributes or you will see that something changed, but will not be able to see what exactly changed.
| Name | Field | Insertion String | OS | Example | ||
|---|---|---|---|---|---|---|
| Group Name | TargetUserName | %1 | Any | ServiceDeskMain | ||
| Group Domain | TargetDomainName | %2 | Any | DOMAIN | ||
| Security ID | TargetSid | %3 | Any | S-1-5-21-3457937927-2839227994-823803824-6119 | ||
| Security ID | SubjectUserSid | %4 | Any | S-1-5-21-3457937927-2839227994-823803824-1104 | ||
| Account Name | SubjectUserName | %5 | Any | dadmin | ||
| Account Domain | SubjectDomainName | %6 | Any | DOMAIN | ||
| Logon ID | SubjectLogonId | %7 | Any | 0x3007b | ||
| Privileges | PrivilegeList | %8 | Any | View Codes | ||
| SAM Account Name | SamAccountName | %9 | Any | ServiceDeskMain | ||
| SID History | SidHistory | %10 | Any | - | ||
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Distribution Group Management"
LEFT/RIGHT arrow keys for navigation
Back to List