Windows EventInformation
Windows Event ID 4754 – Microsoft-Windows-Security-Auditing: Security-Enabled Universal Group Member Added
Event ID 4754 fires when a member is added to a security-enabled universal group in Active Directory. This audit event tracks group membership changes for compliance and security monitoring.