Event Log Security - Windows Event Search

ID	Event Description
4744	A security-disabled local group was created
4745	A security-disabled local group was changed
4746	A member was added to a security-disabled local group
4747	A member was removed from a security-disabled local group
4748	A security-disabled local group was deleted
4749	A security-disabled global group was created Domain Controller, Audit Success
4750	A security-disabled global group was changed Domain Controller, Audit Success
4751	A member was added to a security-disabled global group Domain Controller, Audit Success
4752	A member was removed from a security-disabled global group Domain Controller, Audit Success
4753	A security-disabled global group was deleted Domain Controller, Audit Success
4759	A security-disabled universal group was created Domain Controller
4760	A security-disabled universal group was changed Domain Controller
4761	A member was added to a security-disabled universal group Domain Controller
4762	A member was removed from a security-disabled universal group Domain Controller
4763	A security-disabled universal group was deleted Domain Controller