Event ID 4757

A member was removed from a security-enabled universal group

A member was removed from a security-enabled universal group.

Subject:
    Security ID:    %6
    Account Name:   %7
    Account Domain: %8
    Logon ID:       %9

Member:
    Security ID:  %2
    Account Name: %1

Group:
    Security ID:  %5
    Group Name:   %3
    Group Domain: %4

Additional Information:
    Privileges:   %10




NameFieldInsertion StringOSExample
Account NameMemberName%1Any N=Administrator,CN=Users,DC=domaint,DC=dom
Security IDMemberSid%2Any S-1-5-21-345695894-305466303-1622526952-500
Group NameTargetUserName%3Any DOMAIN
Group DomainTargetDomainName%4Any DOMAIN
Security IDTargetSid%5Any S-1-5-21-345695894-305466303-1622526952-1106
Security IDSubjectUserSid%6Any S-1-5-21-345695894-305466303-1622526952-500
Account NameSubjectUserName%7Any Administrator
Account DomainSubjectDomainName%8Any DOMAIN
Logon IDSubjectLogonId%9Any 0x3ba1b5
PrivilegesPrivilegeList%10Any -


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Security Group Management"



LEFT/RIGHT arrow keys for navigation

Back to List