Event ID 4964
Special groups have been assigned to a new logonSpecial groups have been assigned to a new logon.
Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
Logon GUID: %5
New Logon:
Security ID: %6
Account Name: %7
Account Domain: %8
Logon ID: %9
Logon GUID: %10
Special Groups Assigned: %11
Auditing:
Conditional
Enable auditing if you are utilizing the "Special Groups" windows feature.
Volume:
When "Special Groups" are enabled, volume depends on the configuration and types of users logging on.
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Special Logon"
LEFT/RIGHT arrow keys for navigation
Back to List