Windows EventInformation
Windows Event ID 4756 – Microsoft-Windows-Security-Auditing: Universal Security Group Member Added
Event ID 4756 fires when a member is added to a universal security group in Active Directory. This security audit event tracks group membership changes for compliance and security monitoring.