Windows Event ID 4731 – Microsoft-Windows-Security-Auditing: Security-Enabled Local Group Member Added

Start by examining the specific details of the Event ID 4731 entry to understand what change occurred.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log for Event ID 4731 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4731 in the Event IDs field and click OK
5. Double-click on a 4731 event to view its details
6. Review the General tab for key information:
   • Subject: Who performed the action
   • Member: Which account was added
   • Group: Target group name and SID
   • Privileges: Any special privileges used
7. Check the Details tab for raw XML data if needed for deeper analysis

Use PowerShell to programmatically analyze Event ID 4731 occurrences and extract relevant information.

1. Open PowerShell as Administrator
2. Query recent 4731 events with basic filtering:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4731} -MaxEvents 50

3. Extract detailed information from the events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4731} -MaxEvents 20 | ForEach-Object {
       $xml = [xml]$_.ToXml()
       $eventData = $xml.Event.EventData.Data
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = ($eventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           MemberName = ($eventData | Where-Object {$_.Name -eq 'MemberName'}).'#text'
           GroupName = ($eventData | Where-Object {$_.Name -eq 'GroupName'}).'#text'
           MemberSid = ($eventData | Where-Object {$_.Name -eq 'MemberSid'}).'#text'
       }
   }

4. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4731; StartTime=$StartTime; EndTime=$EndTime}

5. Export results to CSV for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4731} -MaxEvents 100 | 
   Select-Object TimeCreated, Id, LevelDisplayName, Message | 
   Export-Csv -Path "C:\Temp\Event4731_Analysis.csv" -NoTypeInformation

Cross-reference the event data with current group memberships to understand the impact of the changes.

1. List all local groups on the system:

   Get-LocalGroup

2. Check membership of specific security groups mentioned in the events:

   Get-LocalGroupMember -Group "Administrators"
   Get-LocalGroupMember -Group "Remote Desktop Users"
   Get-LocalGroupMember -Group "Backup Operators"

3. For a comprehensive view of all group memberships:

   Get-LocalGroup | ForEach-Object {
       $groupName = $_.Name
       Write-Host "Group: $groupName" -ForegroundColor Green
       try {
           Get-LocalGroupMember -Group $groupName | Select-Object Name, ObjectClass, PrincipalSource
       } catch {
           Write-Host "  No members or access denied" -ForegroundColor Yellow
       }
       Write-Host ""
   }

4. Compare with domain group memberships if applicable:

   net user [username] /domain

5. Use Computer Management for GUI verification:
   • Right-click This PC → Manage
   • Expand Local Users and Groups → Groups
   • Double-click groups mentioned in Event 4731 to verify current membership

Ensure proper audit policy configuration to capture all relevant group membership changes.

1. Check current audit policy settings:

   auditpol /get /subcategory:"Security Group Management"

2. Enable comprehensive auditing for security group management:

   auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable

3. Verify the policy is applied:

   auditpol /get /subcategory:"Security Group Management"

4. Configure via Group Policy for domain environments:
   • Open Group Policy Management Console
   • Edit the appropriate GPO
   • Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Expand Account Management
   • Configure Audit Security Group Management for both Success and Failure
5. Check Security log size and retention settings:

   Get-WinEvent -ListLog Security | Select-Object LogName, MaximumSizeInBytes, RecordCount

6. Increase log size if needed:

   wevtutil sl Security /ms:104857600

Set up proactive monitoring to detect and alert on suspicious group membership changes.

1. Create a PowerShell script for continuous monitoring:

   # Save as Monitor-GroupChanges.ps1
   $LastCheck = (Get-Date).AddMinutes(-5)
   $Events = Get-WinEvent -FilterHashtable @{
       LogName='Security'
       Id=4731
       StartTime=$LastCheck
   } -ErrorAction SilentlyContinue
   
   if ($Events) {
       foreach ($Event in $Events) {
           $xml = [xml]$Event.ToXml()
           $EventData = $xml.Event.EventData.Data
           $GroupName = ($EventData | Where-Object {$_.Name -eq 'GroupName'}).'#text'
           $MemberName = ($EventData | Where-Object {$_.Name -eq 'MemberName'}).'#text'
           $SubjectUserName = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           
           # Alert for critical groups
           if ($GroupName -in @('Administrators', 'Domain Admins', 'Enterprise Admins')) {
               Write-Host "ALERT: $MemberName added to $GroupName by $SubjectUserName" -ForegroundColor Red
               # Add email notification or SIEM integration here
           }
       }
   }

2. Schedule the script using Task Scheduler:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-GroupChanges.ps1"
   $Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
   $Principal = New-ScheduledTaskPrincipal -UserID "SYSTEM" -LogonType ServiceAccount
   Register-ScheduledTask -TaskName "MonitorGroupChanges" -Action $Action -Trigger $Trigger -Principal $Principal

3. Configure Windows Event Forwarding for centralized logging:
   • On collector server: wecutil qc
   • Create subscription: wecutil cs subscription.xml
   • Configure source computers to forward Security events
4. Set up custom Event Viewer views:
   • In Event Viewer, right-click Custom Views → Create Custom View
   • Filter for Event ID 4731 with specific criteria
   • Save as "Critical Group Changes" for quick access
5. Integrate with SIEM solutions by configuring log forwarding or using Windows Event Collector