Event ID 4728: A member was added to a security-enabled global group
Written on domain controllers when an account is added to a global security group, such as Domain Admins.
- Log
- Security
- Category
- Group management
Why it matters
- Additions to Domain Admins, Enterprise Admins or other privileged groups should be rare and expected; alert on them.
What to check
Check the group name, the member added and who made the change.
How to turn it on
Advanced Audit Policy: Account Management > Audit Security Group Management.
MITRE ATT&CK
- T1098 Account Manipulation