Windows Security Log Events



(LOGbinder for SharePoint)
(LOGbinder for SQL Server)
(LOGbinder for Exchange)
(MS Sysinternals Sysmon)
Windows Audit Categories:

Subcategories:

Windows Versions:
Required when sub-category selected.
Category: Account Management
Subcategory: Security Group Management
Windows 4727 A security-enabled global group was created
Windows 4728 A member was added to a security-enabled global group
Windows 4729 A member was removed from a security-enabled global group
Windows 4730 A security-enabled global group was deleted
Windows 4731 A security-enabled local group was created
Windows 4732 A member was added to a security-enabled local group
Windows 4733 A member was removed from a security-enabled local group
Windows 4734 A security-enabled local group was deleted
Windows 4735 A security-enabled local group was changed
Windows 4737 A security-enabled global group was changed
Windows 4754 A security-enabled universal group was created
Windows 4755 A security-enabled universal group was changed
Windows 4756 A member was added to a security-enabled universal group
Windows 4757 A member was removed from a security-enabled universal group
Windows 4758 A security-enabled universal group was deleted
Windows 4764 A groups type was changed
Windows 4799 A security-enabled local group membership was enumerated

Stay up-to-date on the Latest in Cybersecurity
Sign up for the Ultimate IT Security newsletter to hear about the latest webinars, patches, CVEs, attacks, and more.
Work Email:

 

Upcoming Webinars
Additional Resources
    Encyclopedia
    •Event IDs
    •All Event IDs
    •Audit Policy

    Go To Event ID:

    Security Log
    Quick Reference
    Chart
    Download now!