Windows Security Log Event ID 661
661: Security Enabled Universal Group Member Removed
On this page
Member removed from security universal group. "Caller user" removed "member name" from the "target" group. Member may be a user, computer or another group.
Type:
AD has 2 types of groups: Security and Distribution. Distribution (security disabled) groups are for distribution lists in Exchange and cannot be assigned permissions or rights. Security (security enabled) groups can be used for permissions, rights and as distribution lists.
Scope:
AD has 3 scopes of groups: Local, Global, Universal. See knowledge base article 326265.
This event is logged only on Domain Controllers.
Free Security Log Resources by Randy
- Member Name: %1
- Member ID: %2
- Target Account Name: %3
- Target Domain: %4
- Target Account ID: %5
- Caller User Name: %6
- Caller Domain: %7
- Caller Logon ID: %8
- Privileges: %9
Setup PowerShell Audit Log Forwarding in 4 Minutes