Event ID: 4764

A group’s type was changed

A group’s type was changed.

    Security ID:    %5
    Account Name:   %6
    Account Domain: %7
    Logon ID:       %8

Change Type:        %1

    Security ID:  %4
    Group Name:   %2
    Group Domain: %3

Additional Information:
    Privileges:     %9

This event generates every time group’s type is changed and generates for both security and distribution groups.

Microsoft Documentation

Event ID - 4764

Name Field Insertion String OS Example
Change Type GroupTypeChange %1 Any Security Enabled Local Group Changed to Security Disabled Local Group.
Group Name TargetUserName %2 Any CompanyAuditors
Group Domain TargetDomainName %3 Any DOMAIN
Security ID TargetSid %4 Any S-1-5-21-3457937927-2839227994-823803824-6608
Security ID SubjectUserSid %5 Any S-1-5-21-3457937927-2839227994-823803824-1104
Account Name SubjectUserName %6 Any dadmin
Account Domain SubjectDomainName %7 Any DOMAIN
Logon ID SubjectLogonId %8 Any 0x38200
Privileges PrivilegeList %9 Any View Codes

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Security Group Management"

LEFT/RIGHT arrow keys for navigation

Back to List