Event ID: 4750

A security-disabled global group was changed

A security-disabled global group was changed.

Subject:
    Security ID:    %4
    Account Name:   %5
    Account Domain: %6
    Logon ID:       %7

Group:
    Security ID:  %3
    Group Name:   %1
    Group Domain: %2

Changed Attributes:
    SAM Account Name:   %9
    SID History:        %10

Additional Information:
    Privileges:     %8
Microsoft Documentation

Event ID - 4750



This event generates every time security-disabled (distribution) global group is changed.

Some changes do not invoke a 4750 event, for example, changes made using the Active Directory Users and Computers management console in Managed By tab in group account properties.

If you change the name of the group (SAM Account Name), you also get “4781: The name of an account was changed” if “Audit User Account Management” subcategory success auditing is enabled.

If you change the group type, you get a change event from the new group type auditing subcategory instead of 4750. If you need to monitor for group type changes, it is better to monitor for “4764: A group’s type was changed.” These events are generated for any group type when group type is changed. “Audit Security Group Management” subcategory success auditing must be enabled.

From 4750 event you can get information about changes of sAMAccountName and sIDHistory attributes or you will see that something changed, but will not be able to see what exactly changed.



Name Field Insertion String OS Example
Group Name TargetUserName %1 Any ServiceDeskMain
Group Domain TargetDomainName %2 Any DOMAIN
Security ID TargetSid %3 Any S-1-5-21-3457937927-2839227994-823803824-6119
Security ID SubjectUserSid %4 Any S-1-5-21-3457937927-2839227994-823803824-1104
Account Name SubjectUserName %5 Any dadmin
Account Domain SubjectDomainName %6 Any DOMAIN
Logon ID SubjectLogonId %7 Any 0x3007b
Privileges PrivilegeList %8 Any View Codes
SAM Account Name SamAccountName %9 Any ServiceDeskMain
SID History SidHistory %10 Any -


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Distribution Group Management"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List