Event ID: 639

Security Enabled Local Group Changed

Security Enabled Local Group Changed:
    Target Account Name:    %1
    Target Domain:  %2
    Target Account ID:  %3
    Caller User Name:   %4
    Caller Domain:  %5
    Caller Logon ID:    %6
    Privileges: %7
 Changed Attributes:
    Sam Account Name:   %8
    Sid History:    %9

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Account Management"
How to enable Windows Auditing

Operating Systems:
Windows 2003 Windows XP

Audit Category:
Account Management
Corresponding Events:

LEFT/RIGHT arrow keys for navigation

Back to List