Event ID 4756: A member was added to a security-enabled universal group
Written on domain controllers when an account is added to a universal security group, such as Enterprise Admins or Schema Admins.
- Log
- Security
- Category
- Group management
Why it matters
- Enterprise Admins and Schema Admins should almost always be empty; any addition needs explaining.
What to check
Check the group, the member added and who made the change.
How to turn it on
Advanced Audit Policy: Account Management > Audit Security Group Management.
MITRE ATT&CK
- T1098 Account Manipulation