#local-groups

1 article

Windows Events1

Windows security monitoring dashboard displaying Event ID 4735 local group change audit logs

Event 4735

Microsoft-Windows-Security-Auditing

Windows EventInformation

Windows Event ID 4735 – Microsoft-Windows-Security-Auditing: Security-Enabled Local Group Changed

Event ID 4735 fires when a security-enabled local group is modified on Windows systems. This security audit event tracks changes to local group membership, properties, or permissions for compliance and security monitoring.

March 1812 min