Windows Security Log Events
All Sources
Windows Audit
SharePoint Audit
(
LOGbinder for SharePoint
)
SQL Server Audit
(
LOGbinder for SQL Server
)
Exchange Audit
(
LOGbinder for Exchange
)
Sysmon
(
MS Sysinternals Sysmon
)
Windows Audit Categories:
All categories
Account Logon
Account Management
Directory Service
Logon/Logoff
Non Audit (Event Log)
Object Access
Policy Change
Privilege Use
Process Tracking
System
Uncategorized
Subcategories:
All subcategories
Application Group Management
Computer Account Management
Distribution Group Management
Other Account Management Events
Security Group Management
User Account Management
Windows Versions:
All events
Win2000, XP and Win2003 only
Win2008, Win2012R2, Win2016 and Win10+, Win2019
Required when sub-category selected.
Category:
Account Management
Subcategory:
Security Group Management
Windows
4727
A security-enabled global group was created
Windows
4728
A member was added to a security-enabled global group
Windows
4729
A member was removed from a security-enabled global group
Windows
4730
A security-enabled global group was deleted
Windows
4731
A security-enabled local group was created
Windows
4732
A member was added to a security-enabled local group
Windows
4733
A member was removed from a security-enabled local group
Windows
4734
A security-enabled local group was deleted
Windows
4735
A security-enabled local group was changed
Windows
4737
A security-enabled global group was changed
Windows
4754
A security-enabled universal group was created
Windows
4755
A security-enabled universal group was changed
Windows
4756
A member was added to a security-enabled universal group
Windows
4757
A member was removed from a security-enabled universal group
Windows
4758
A security-enabled universal group was deleted
Windows
4764
A groups type was changed
Windows
4799
A security-enabled local group membership was enumerated
Stay up-to-date on the Latest in Cybersecurity
Sign up for the Ultimate IT Security newsletter to hear about the latest webinars, patches, CVEs, attacks, and more.
Work Email:
Upcoming Webinars
Pentesting Large Language Model Apps using the OWASP Top 10 for LLM Apps
Additional Resources
Encyclopedia
•
Event IDs
•
All Event IDs
•
Audit Policy
Go To Event ID:
Security Log
Quick Reference
Chart
Download now!
Tweet
User name:
Password:
/
Forgot?
Register
February 2025
Patch Tuesday
"Patch Tuesday - Four Zero Days; Average Month Overall " - sponsored by LOGbinder.com
Home
Cookies help us deliver the best experience on our website. By using our website, you agree to the use of cookies.