Windows Event ID 4728 – Microsoft-Windows-Security-Auditing: A Member Was Added to a Security-Enabled Global Group

Start by examining the complete event details to understand who made the change and which accounts were affected.

1. Open Event Viewer on the domain controller where the event occurred
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4728 using the filter option or search functionality
4. Double-click the event to view detailed information including:
   • Subject: Account that performed the action
   • Member: Account that was added to the group
   • Group: Target security group details
   • Additional Information: Privileges used and logon session
5. Note the timestamp, source computer, and correlation with other security events
6. Cross-reference the Subject account with expected administrative activities

Use PowerShell to analyze multiple Event ID 4728 occurrences and identify patterns or anomalies in group membership changes.

1. Open PowerShell as Administrator on a domain controller or management workstation
2. Query recent group membership additions:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='Subject';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Subject:*'} | Select-Object -First 3) -join ' '}}, @{Name='Group';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Group:*'} | Select-Object -First 2) -join ' '}} | Format-Table -AutoSize

3. Filter for specific high-privilege groups:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728} | Where-Object {$_.Message -like '*Domain Admins*' -or $_.Message -like '*Enterprise Admins*' -or $_.Message -like '*Schema Admins*'} | Select-Object TimeCreated, Message

4. Analyze events by specific user account:

   $TargetUser = "username"
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728} | Where-Object {$_.Message -like "*$TargetUser*"} | Select-Object TimeCreated, @{Name='Details';Expression={$_.Message}} | Format-List

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728; StartTime=(Get-Date).AddDays(-7)} | Export-Csv -Path "C:\Temp\GroupMembershipChanges.csv" -NoTypeInformation

Cross-reference Event ID 4728 with actual Active Directory group membership to verify legitimate changes and detect potential issues.

1. Identify the affected group from the event details
2. Check current group membership using Active Directory PowerShell:

   Import-Module ActiveDirectory
   $GroupName = "Domain Admins"  # Replace with actual group name
   Get-ADGroupMember -Identity $GroupName | Select-Object Name, SamAccountName, ObjectClass, DistinguishedName

3. Review group modification history:

   Get-ADGroup -Identity $GroupName -Properties whenChanged, whenCreated, managedBy | Select-Object Name, whenCreated, whenChanged, managedBy

4. Check for recent group membership changes across multiple domain controllers:

   $DCs = Get-ADDomainController -Filter *
   foreach ($DC in $DCs) {
       Write-Host "Checking $($DC.Name)..."
       Get-WinEvent -ComputerName $DC.Name -FilterHashtable @{LogName='Security'; Id=4728; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue | Select-Object TimeCreated, MachineName
   }

5. Validate the change was authorized by checking change management records or service desk tickets
6. If unauthorized, immediately review the added account's current permissions and recent activities

Set up proactive monitoring to detect and alert on suspicious group membership changes in real-time.

1. Create a custom Event Viewer task for immediate notification:
   • In Event Viewer, right-click on the Event ID 4728 entry
   • Select Attach Task To This Event
   • Configure email alerts or script execution for high-privilege group changes
2. Configure Windows Event Forwarding (WEF) to centralize events:

   # On collector server
   wecutil qc
   wecutil cs subscription.xml  # Create subscription file first

3. Set up PowerShell-based monitoring script:

   # Save as MonitorGroupChanges.ps1
   $HighPrivilegeGroups = @("Domain Admins", "Enterprise Admins", "Schema Admins", "Administrators")
   
   Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.EventCode = 4728" -Action {
       $Event = $Event.SourceEventArgs.NewEvent.TargetInstance
       $Message = $Event.Message
       
       foreach ($Group in $HighPrivilegeGroups) {
           if ($Message -like "*$Group*") {
               Send-MailMessage -To "security@company.com" -From "monitoring@company.com" -Subject "ALERT: High-Privilege Group Modified" -Body $Message -SmtpServer "mail.company.com"
               break
           }
       }
   }

4. Configure Group Policy to enable advanced audit policies:
   • Navigate to Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management
   • Enable Audit Security Group Management for Success events
5. Implement SIEM integration using Windows Event Log forwarding or agents

Conduct thorough forensic analysis when Event ID 4728 indicates potential security incidents or unauthorized access.

1. Preserve evidence by exporting relevant security logs:

   # Export security events around the incident timeframe
   $StartTime = (Get-Date "2026-03-18 14:00:00")
   $EndTime = (Get-Date "2026-03-18 16:00:00")
   Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$StartTime; EndTime=$EndTime} | Export-Clixml -Path "C:\Forensics\SecurityEvents_$(Get-Date -Format 'yyyyMMdd_HHmmss').xml"

2. Analyze the complete logon session of the subject account:

   # Find logon events for the subject account
   $SubjectAccount = "DOMAIN\username"  # From Event ID 4728 details
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4634} | Where-Object {$_.Message -like "*$SubjectAccount*"} | Select-Object TimeCreated, Id, Message

3. Check for privilege escalation events preceding the group modification:

   # Look for privilege use events
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672,4673,4674} -MaxEvents 100 | Where-Object {$_.TimeCreated -ge $StartTime -and $_.TimeCreated -le $EndTime} | Format-Table TimeCreated, Id, Message -Wrap

4. Examine related Active Directory changes:

   # Check for other AD modifications
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4727,4728,4729,4730,4731,4732,4733,4734,4735,4737,4754,4755,4756,4757,4758} | Where-Object {$_.TimeCreated -ge $StartTime.AddMinutes(-30) -and $_.TimeCreated -le $EndTime.AddMinutes(30)} | Sort-Object TimeCreated

5. Document findings and create incident timeline:
   • Record all relevant event IDs, timestamps, and affected accounts
   • Identify the attack vector and potential impact scope
   • Determine if additional systems or accounts were compromised
   • Implement containment measures if unauthorized access is confirmed
6. Review and update security policies based on investigation findings