Windows Event ID 4730 – Microsoft-Windows-Security-Auditing: Security-Enabled Universal Group Deleted

Start by examining the complete event details to understand what group was deleted and by whom.

1. Open Event Viewer on the domain controller where the event occurred
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4730 using the filter option
4. Double-click the event to view full details
5. Note the Subject Security ID and Account Name fields to identify who performed the deletion
6. Record the Target Account Name and Target Domain to identify the deleted group
7. Check the Logon ID to correlate with other events from the same session

Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4730} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Determine what the deleted group contained and its permission assignments to assess impact.

1. Check if the group had any remaining members before deletion by reviewing recent Event ID 4729 (member removed from group) events
2. Search for Event ID 4728 entries to see historical group membership additions
3. Use PowerShell to search for related group events:

# Search for all group-related events for the deleted group
$GroupName = "DeletedGroupName"
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4728,4729,4730} | Where-Object {$_.Message -like "*$GroupName*"} | Sort-Object TimeCreated

4. Check Active Directory Recycle Bin if enabled to view the group's attributes before deletion:

Get-ADObject -Filter {Name -eq "DeletedGroupName"} -IncludeDeletedObjects -Properties *

5. Review file system and application logs for access denied errors that might indicate permission issues caused by the group deletion

Investigate the complete administrative session to understand if the deletion was part of legitimate maintenance or potentially malicious activity.

1. Use the Logon ID from the 4730 event to find the initial logon event:

# Replace LogonID with the actual value from Event 4730
$LogonID = "0x12345678"
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624} | Where-Object {$_.Message -like "*$LogonID*"}

2. Search for all events during that logon session to see other activities:

# Find all events for the specific logon session
Get-WinEvent -FilterHashtable @{LogName='Security'} | Where-Object {$_.Message -like "*$LogonID*"} | Sort-Object TimeCreated

3. Check for suspicious patterns such as multiple group deletions, privilege escalation attempts, or unusual logon times
4. Verify the source IP address and computer name from the logon event match expected administrative workstations
5. Review Event ID 4634 (account logged off) to determine session duration
6. Cross-reference with change management tickets or scheduled maintenance windows

Set up monitoring to detect future unauthorized group deletions and establish proper change controls.

1. Create a PowerShell script to monitor for Event ID 4730 and send alerts:

# Monitor for universal group deletions
$Query = @"

  
    *[System[EventID=4730]]
  

"@

Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=4730" -Action {
    $Event = $Event.SourceEventArgs.NewEvent
    Send-MailMessage -To "security@company.com" -From "dc-monitor@company.com" -Subject "Universal Group Deleted" -Body "Group deletion detected: $($Event.Message)" -SmtpServer "mail.company.com"
}

2. Configure Windows Event Forwarding to centralize security events from all domain controllers
3. Set up SIEM rules to correlate group deletions with other suspicious activities
4. Implement Group Policy to restrict group management permissions to specific administrative accounts
5. Enable Active Directory Recycle Bin for group recovery capabilities:

Enable-ADOptionalFeature -Identity "Recycle Bin Feature" -Scope ForestOrConfigurationSet -Target (Get-ADForest).Name

5. Create a scheduled task to regularly audit group memberships and detect unauthorized changes

Perform comprehensive forensic analysis and implement recovery procedures for critical group deletions.

1. Export all related security events for forensic analysis:

# Export security events related to the incident
$StartTime = (Get-Date).AddDays(-7)
$EndTime = Get-Date
Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$StartTime; EndTime=$EndTime; ID=4728,4729,4730,4731,4732,4733} | Export-Csv -Path "C:\Forensics\GroupEvents.csv" -NoTypeInformation

2. Analyze domain controller replication logs to determine if the deletion replicated to all DCs:

# Check replication status
repadmin /showrepl /csv | ConvertFrom-Csv | Where-Object {$_.'Source DSA' -ne $null}

3. If Active Directory Recycle Bin is enabled, restore the deleted group:

# Restore deleted universal group
Get-ADObject -Filter {Name -eq "DeletedGroupName"} -IncludeDeletedObjects | Restore-ADObject

4. If Recycle Bin is not available, restore from authoritative backup using ntdsutil or Windows Server Backup
5. Document the incident timeline, affected systems, and recovery actions taken
6. Review and update group management procedures to prevent similar incidents
7. Consider implementing additional controls such as approval workflows for group deletions