Event ID: 4757

A member was removed from a security-enabled universal group

A member was removed from a security-enabled universal group.

    Security ID:    %6
    Account Name:   %7
    Account Domain: %8
    Logon ID:       %9

    Security ID:  %2
    Account Name: %1

    Security ID:  %5
    Group Name:   %3
    Group Domain: %4

Additional Information:
    Privileges:   %10

Name Field Insertion String OS Example
Account Name MemberName %1 Any N=Administrator,CN=Users,DC=domaint,DC=dom
Security ID MemberSid %2 Any S-1-5-21-345695894-305466303-1622526952-500
Group Name TargetUserName %3 Any DOMAIN
Group Domain TargetDomainName %4 Any DOMAIN
Security ID TargetSid %5 Any S-1-5-21-345695894-305466303-1622526952-1106
Security ID SubjectUserSid %6 Any S-1-5-21-345695894-305466303-1622526952-500
Account Name SubjectUserName %7 Any Administrator
Account Domain SubjectDomainName %8 Any DOMAIN
Logon ID SubjectLogonId %9 Any 0x3ba1b5
Privileges PrivilegeList %10 Any -

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Security Group Management"
How to enable Windows Auditing

LEFT/RIGHT arrow keys for navigation

Back to List