Event ID: 4751

A member was added to a security-disabled global group

A member was added to a security-disabled global group.

Subject:
    Security ID:    %6
    Account Name:   %7
    Account Domain: %8
    Logon ID:       %9

Member:
    Security ID:        %2
    Account Name:       %1

Group:
    Security ID:  %5
    Group Name:   %3
    Group Domain: %4

Additional Information:
    Privileges:     %10
Microsoft Documentation

Event ID - 4751



This event generates every time a new member was added to a security-disabled (distribution) global group.

For every added member you will get separate 4751 event.

You will typically see “4750: A security-disabled global group was changed.” event without any changes in it prior to 4751 event.



Name Field Insertion String OS Example
Account Name MemberName %1 Any CN=Auditor,CN=Users,DC=contoso,DC=local
Security ID MemberSid %2 Any S-1-5-21-3457937927-2839227994-823803824-2104
Group Name TargetUserName %3 Any ServiceDeskSecond
Group Domain TargetDomainName %4 Any DOMAIN
Security ID TargetSid %5 Any S-1-5-21-3457937927-2839227994-823803824-6119
Security ID SubjectUserSid %6 Any S-1-5-21-3457937927-2839227994-823803824-1104
Account Name SubjectUserName %7 Any dadmin
Account Domain SubjectDomainName %8 Any DOMAIN
Logon ID SubjectLogonId %9 Any 0x3007b
Privileges PrivilegeList %10 Any View Codes


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Distribution Group Management"
How to enable Windows Auditing


Audit Category:
Account Management

Audit Subcategory:
Distribution Group Management
Legacy Events:
655

Correlated Events:
4750

LEFT/RIGHT arrow keys for navigation

Back to List