Windows Event ID 4729 – Microsoft-Windows-Security-Auditing: A Member was Removed from a Security-Enabled Global Group

Start by examining the event details to understand what happened and who initiated the change.

1. Open Event Viewer on the domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4729 using the filter option
4. Double-click the event to view detailed information
5. Review the following key fields:
   • Subject: Account that performed the removal
   • Member: Account that was removed from the group
   • Group: Target group name and domain
   • Additional Information: Privileges used for the operation

Use this PowerShell command to quickly retrieve recent 4729 events:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4729} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Use PowerShell to perform advanced filtering and analysis of group membership removal events.

1. Query events for a specific group:

$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4729} -MaxEvents 100
$Events | Where-Object {$_.Message -like '*GroupName*'} | Select-Object TimeCreated, @{Name='User';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Account Name:*'})[0] -replace '.*Account Name:\s*'}}, @{Name='Group';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Group Name:*'})[0] -replace '.*Group Name:\s*'}}

2. Search for events within a specific time range:

$StartTime = (Get-Date).AddDays(-7)
$EndTime = Get-Date
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4729; StartTime=$StartTime; EndTime=$EndTime} | Format-Table TimeCreated, Message -Wrap

3. Export events to CSV for further analysis:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4729} -MaxEvents 500 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path "C:\Temp\GroupRemovals.csv" -NoTypeInformation

Investigate the current state of the group and verify the membership change was authorized.

1. Check current group membership using PowerShell:

Get-ADGroupMember -Identity "GroupName" | Select-Object Name, SamAccountName, ObjectClass

2. Review group modification history:

Get-ADGroup -Identity "GroupName" -Properties whenChanged, whenCreated, modifyTimeStamp | Select-Object Name, whenCreated, whenChanged, modifyTimeStamp

3. Check for related events (4728 for additions, 4730 for deletions):

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728,4729,4730} -MaxEvents 50 | Where-Object {$_.Message -like '*GroupName*'} | Sort-Object TimeCreated

4. Verify the user who performed the action has appropriate permissions:

Get-ADUser -Identity "AdminUsername" -Properties MemberOf | Select-Object Name, @{Name='Groups';Expression={$_.MemberOf -join '; '}}

Set up proactive monitoring to track group membership changes and detect unauthorized modifications.

1. Create a scheduled task to monitor critical group changes:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\MonitorGroupChanges.ps1"
$Trigger = New-ScheduledTaskTrigger -Daily -At "09:00AM"
Register-ScheduledTask -TaskName "Monitor Group Changes" -Action $Action -Trigger $Trigger -User "SYSTEM"

2. Create the monitoring script (C:\Scripts\MonitorGroupChanges.ps1):

# Monitor Group Changes Script
$Yesterday = (Get-Date).AddDays(-1)
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4729; StartTime=$Yesterday}

if ($Events) {
    $Report = $Events | ForEach-Object {
        $Message = $_.Message
        $TimeCreated = $_.TimeCreated
        # Parse event details
        [PSCustomObject]@{
            Time = $TimeCreated
            Event = "Member Removed"
            Details = $Message
        }
    }
    $Report | Export-Csv -Path "C:\Logs\GroupChanges_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
}

3. Configure Windows Event Forwarding for centralized logging:

winrm quickconfig
wecutil cs subscription.xml

Perform detailed forensic analysis for security incidents or compliance audits involving group membership changes.

1. Generate a comprehensive audit report:

$StartDate = Read-Host "Enter start date (MM/DD/YYYY)"
$EndDate = Read-Host "Enter end date (MM/DD/YYYY)"
$Start = Get-Date $StartDate
$End = Get-Date $EndDate

$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4729; StartTime=$Start; EndTime=$End}

$Report = $Events | ForEach-Object {
    $EventXML = [xml]$_.ToXml()
    $EventData = $EventXML.Event.EventData.Data
    
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        SubjectUserName = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
        SubjectDomainName = ($EventData | Where-Object {$_.Name -eq 'SubjectDomainName'}).'#text'
        MemberName = ($EventData | Where-Object {$_.Name -eq 'MemberName'}).'#text'
        MemberSid = ($EventData | Where-Object {$_.Name -eq 'MemberSid'}).'#text'
        TargetUserName = ($EventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
        TargetDomainName = ($EventData | Where-Object {$_.Name -eq 'TargetDomainName'}).'#text'
    }
}

$Report | Export-Csv -Path "C:\Audit\GroupRemovalAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

2. Cross-reference with authentication logs:

$GroupEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4729} -MaxEvents 100
$AuthEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625} -MaxEvents 1000

# Correlate events by user and time
$Correlation = foreach ($GroupEvent in $GroupEvents) {
    $EventTime = $GroupEvent.TimeCreated
    $TimeWindow = $EventTime.AddMinutes(-30)..$EventTime.AddMinutes(30)
    
    $RelatedAuth = $AuthEvents | Where-Object {$_.TimeCreated -ge $TimeWindow[0] -and $_.TimeCreated -le $TimeWindow[1]}
    
    [PSCustomObject]@{
        GroupChangeTime = $EventTime
        GroupEvent = $GroupEvent.Message
        RelatedAuthentications = $RelatedAuth.Count
    }
}