Event ID 649

Security Disabled Local Group Changed:
    Target Account Name:    %1
    Target Domain:  %2
    Target Account ID:  %3
    Caller User Name:   %4
    Caller Domain:  %5
    Caller Logon ID:    %6
    Privileges: %7
 Changed Attributes:
    Sam Account Name:   %8
    Sid History:    %9