Event ID: 4764
A group’s type was changedA group’s type was changed.
Subject:
Security ID: %5
Account Name: %6
Account Domain: %7
Logon ID: %8
Change Type: %1
Group:
Security ID: %4
Group Name: %2
Group Domain: %3
Additional Information:
Privileges: %9This event generates every time group’s type is changed and generates for both security and distribution groups.
Microsoft Documentation
| Name | Field | Insertion String | OS | Example | ||
|---|---|---|---|---|---|---|
| Change Type | GroupTypeChange | %1 | Any | Security Enabled Local Group Changed to Security Disabled Local Group. | ||
| Group Name | TargetUserName | %2 | Any | CompanyAuditors | ||
| Group Domain | TargetDomainName | %3 | Any | DOMAIN | ||
| Security ID | TargetSid | %4 | Any | S-1-5-21-3457937927-2839227994-823803824-6608 | ||
| Security ID | SubjectUserSid | %5 | Any | S-1-5-21-3457937927-2839227994-823803824-1104 | ||
| Account Name | SubjectUserName | %6 | Any | dadmin | ||
| Account Domain | SubjectDomainName | %7 | Any | DOMAIN | ||
| Logon ID | SubjectLogonId | %8 | Any | 0x38200 | ||
| Privileges | PrivilegeList | %9 | Any | View Codes | ||
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Security Group Management"
Operating Systems:
Windows 2008 Windows 2008 R2 Windows 2012 Windows 2012 R2 Windows 2016 Windows 2019 Windows 2022Tags:
Domain Controller Audit SuccessLEFT/RIGHT arrow keys for navigation
Back to List