Tools · Windows security and Event Logs · 05 / 27
Detect privileged group changes: Event IDs 4728, 4732, and 4756
Know which event fires for global, local, and universal security groups, and alert on additions to Domain Admins, Administrators, and other privileged groups.
Three scopes, three event IDs
4728 means a member was added to a security-enabled global group, such as Domain Admins. 4732 means a member was added to a security-enabled local group, such as the built-in Administrators group on a computer or domain local groups like Backup Operators on a DC. 4756 means a member was added to a security-enabled universal group, such as Enterprise Admins. The matching removals are 4729, 4733, and 4757.
Knowing the scope matters because searching for one ID alone misses the others. A Domain Admins addition appears as 4728, not 4732.
Groups to watch
At minimum: Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Backup Operators, Server Operators, Print Operators, DnsAdmins, Group Policy Creator Owners, and local Administrators on servers. Several of the operator groups can reach domain control even though their names sound modest.
Use the group’s SID rather than its name in detections where possible, because names can be localized or renamed. Domain Admins always ends in -512, Enterprise Admins in -519, and the built-in Administrators group is S-1-5-32-544.
Lab: query privileged additions
On a lab domain controller, add a test user to Backup Operators and to Domain Admins, then remove them. Query 4728, 4732, and 4756 for the last hour and print the group name, member, and who made the change.
Then write the alert logic: any addition to a group in your watch list, from any subject, raises a ticket that must match an approved change.
$watch = 'Domain Admins','Enterprise Admins','Schema Admins','Administrators','Backup Operators','Account Operators','Server Operators','DnsAdmins'
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728,4732,4756; StartTime=(Get-Date).AddHours(-1)} |
% { $x=[xml]$_.ToXml(); $d=@{}; $x.Event.EventData.Data | % { $d[$_.Name]=$_.'#text' }
[pscustomobject]@{Time=$_.TimeCreated; Id=$_.Id; Group=$d.TargetUserName; Member=$d.MemberName; By=$d.SubjectUserName} } |
Where-Object Group -in $watchWhen an addition was not approved
Remove the member, reset the account’s password, and investigate the subject’s session for how they gained the right to modify the group. Look for other changes from the same subject in the same time window.
Consider a just-in-time model where people are added to privileged groups for hours, not permanently, so additions are expected and removals are automatic.
Diagram
Event ID by group scope
Search all three to cover every privileged group.
- 4728 / 4729
Global groups, such as Domain Admins.
- 4732 / 4733
Local and domain local groups, such as Administrators and Backup Operators.
- 4756 / 4757
Universal groups, such as Enterprise Admins.
Check yourself
1. A user is added to Domain Admins. Which event fires?
2. Why include Backup Operators in a watch list?
3. Why match groups by SID instead of name?