4728: A member was added to a security-enabled global group

On this page

• Description of this event
• Field level details
• Examples
• Discuss this event
• Mini-seminars on this event

The user in Subject: added the user/group/computer in Member: to the Security Global group in Group:.

In Active Directory Users and Computers "Security Enabled" groups are simply referred to as Security groups. AD has 2 types of groups: Security and Distribution. Distribution (security disabled) groups are for distribution lists in Exchange and cannot be assigned permissions or rights. Security (security enabled) groups can be used for permissions, rights and as distribution lists.

Global means the group can be granted access in any trusting domain but may only have members from its own domain. 

This event is only logged on domain controllers.

Description Fields in 4728 Subject: The user and logon session that performed the action. Security ID:  The SID of the account. Account Name: The account logon name. Account Domain: The domain or - in the case of local accounts - computer name. Logon ID is a semi-unique (unique between reboots) number that identifies the logon session.  Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session. Member: Security ID:  The SID of the group's member Account Name:  The distinguished name of the group's member Group: Security ID:  The SID of the affected group Group Name: Name of affected group Group Domain:  Domain of affected group Additional Information: Privileges:  always "-" Top 10 Windows Security Events to Monitor Examples of 4728 A member was added to a security-enabled global group. Subject:    Security ID:  ACME\Administrator    Account Name:  Administrator    Account Domain:  ACME    Logon ID:  0x27a79 Member:    Security ID:  ACME\gkhan    Account Name:  cn=Ghenghis Khan,CN=Users,DC=acme,DC=local Group:    Security ID:  S-1-5-21-3108364787-189202583-342365621-1108    Group Name:  Historical Figures    Group Domain:  ACME Additional Information:    Privileges:  -     Keep me up-to-date on the Windows Security Log. Email*: Bad email address *We will NOT share this

Training for the Windows Security Log

Mini-Seminars Covering Event ID 4728 Monitoring Active Directory for Security and Compliance: How Far Does the Native Audit Log Take You? 11 Ways to Detect System Intrusions with the Security Log Building a Security Dashboard for Your Senior Executives Detecting Compromised Privileged Accounts with the Security Log Real Methods for Detecting True Advanced Persistent Threats Using Logs Beyond Alerting: 7 Critical Security Event Responses That Can Be Automated 27 Most Important Windows Security Events

Discussions on Event ID 4728 Ask a question about this event

 

Upcoming Webinars Solving Windows 2003 End of Life Security Risks: Migration Strategies and Compensating Controls for Beyond July 14, 2015 Eliminating FTP: Securing File Transfers with Secure Shell for Encryption and Compliance Anatomy of a Data Breach: Tracing a Case of Unauthorized File Access with the Windows Security Log

Additional Resources Learn about the SharePoint Audit Log Randy's Review of a Fast, Easy and AFFORDABLE SIEM Security Log Quick Reference Chart Patch Tuesday Analysis

•	All Event IDs
•	Audit Policy