Event ID 648

Security Disabled Local Group Created:
    Target Account Name:    %1
    Target Domain:  %2
    Target Account ID:  %3
    Caller User Name:   %4
    Caller Domain:  %5
    Caller Logon ID:    %6
    Privileges: %7
 Attributes:
    Sam Account Name:   %8
    Sid History:    %9