Event ID 4799

A security-enabled local group membership was enumerated

A security-enabled local group membership was enumerated.

Subject:
    Security ID:    %4
    Account Name:   %5
    Account Domain: %6
    Logon ID:       %7

Group:
    Security ID:  %3
    Group Name:   %1
    Group Domain: %2

Process Information:
    Process ID:   %8
    Process Name: %9


This event generates when a process enumerates the members of a security-enabled local group on the computer or device.

This event doesn't generate when group members were enumerated using Active Directory Users and Computers snap-in.

Microsoft Documentation

Event ID - 4799



NameFieldInsertion StringOSExample
Group NameTargetUserName%1Any Administrator
Group DomainTargetDomainName%2Any Builtin
Security IDTargetSid%3Any S-1-5-32-544
Security IDSubjectUserSid%4Any S-1-5-21-1377283216-344919071-3415362939-1104
Account NameSubjectUserName%5Any dadmin
Account DomainSubjectDomainName%6Any DOMAIN
Logon IDSubjectLogonId%7Any 0x72d9d
Process IDCallerProcessId%8Any 0xc80
Process NameCallerProcessName%9Any C:\Windows\System32\mmc.exe

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Security Group Management"
How to enable Windows Auditing
Recommended Audit Policy

Operating Systems:
Windows 10Windows 2016Windows 2019Windows 11Windows 2022Windows 2025Windows 2025

Tags:
Audit Success
Audit Category:
Account Management

Audit Subcategory:
Security Group Management

LEFT/RIGHT arrow keys for navigation

Back to List