Event ID: 4908

Special Groups Logon table modified

Special Groups Logon table modified.

Special Groups: %1

This event is generated when the list of special groups is updated in the registry or through security policy. The updated list of special groups is indicated in the event.

Microsoft Documentation

Event ID - 4908

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Audit Policy Change"

LEFT/RIGHT arrow keys for navigation

Back to List