Event ID: 4908
Special Groups Logon table modifiedSpecial Groups Logon table modified.
Special Groups: %1
This event is generated when the list of special groups is updated in the registry or through security policy. The updated list of special groups is indicated in the event.
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Audit Policy Change"
Operating Systems:
Windows Vista Windows 2008 Windows 2008 R2 Windows 7 Windows 2012 Windows 2012 R2 Windows 8 Windows 8.1 Windows 10 Windows 2016 Windows 2019Tags:
Audit SuccessLEFT/RIGHT arrow keys for navigation
Back to List