Windows EventInformation
Windows Event ID 4737 – Microsoft-Windows-Security-Auditing: Security-Enabled Global Group Changed
Event ID 4737 fires when a security-enabled global group is modified in Active Directory, tracking changes to group properties, membership, or attributes for security auditing purposes.