Event ID: 4908

Special Groups Logon table modified

Special Groups Logon table modified.

Special Groups: %1

This event is generated when the list of special groups is updated in the registry or through security policy. The updated list of special groups is indicated in the event.
Microsoft Documentation

Event ID - 4908





Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Audit Policy Change"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List