Event ID: 4964Special groups have been assigned to a new logon
Special groups have been assigned to a new logon. Subject: Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Logon GUID: %5 New Logon: Security ID: %6 Account Name: %7 Account Domain: %8 Logon ID: %9 Logon GUID: %10 Special Groups Assigned: %11
Enable auditing if you are utilizing the "Special Groups" windows feature.
When "Special Groups" are enabled, volume depends on the configuration and types of users logging on.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Special Logon"
LEFT/RIGHT arrow keys for navigationBack to List