Event ID 4798
A user's local group membership was enumeratedA user's local group membership was enumerated.
Subject:
Security ID: %4
Account Name: %5
Account Domain: %6
Logon ID: %7
User:
Security ID: %3
Account Name: %1
Account Domain: %2
Process Information:
Process ID: %8
Process Name: %9This event generates when a process enumerates a user's security-enabled local groups on a computer or device.
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"User Account Management" LEFT/RIGHT arrow keys for navigation
Back to List