Windows Event ID 4733 – Microsoft-Windows-Security-Auditing: Security Group Member Removed

Start by examining the specific details of Event ID 4733 to understand what group membership change occurred.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 4733 in the Event IDs field and click OK
5. Double-click on a 4733 event to view detailed information
6. Review the General tab for key details:
   • Subject: Account that performed the removal
   • Member: Account that was removed from the group
   • Group: Security group that was modified
   • Additional Information: Privileges used for the operation
7. Check the Details tab for XML format with complete field information
8. Note the timestamp to correlate with other security events if investigating an incident

Use PowerShell to efficiently search and analyze Event ID 4733 occurrences across your environment.

1. Open PowerShell as Administrator
2. Query recent 4733 events with basic filtering:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4733} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Search for specific group modifications:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4733}
   $Events | Where-Object {$_.Message -like '*Domain Admins*'} | Select-Object TimeCreated, Message

4. Extract structured data from event messages:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4733} -MaxEvents 100
   foreach ($Event in $Events) {
       $XML = [xml]$Event.ToXml()
       $EventData = $XML.Event.EventData.Data
       [PSCustomObject]@{
           TimeCreated = $Event.TimeCreated
           SubjectUserName = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           MemberName = ($EventData | Where-Object {$_.Name -eq 'MemberName'}).'#text'
           GroupName = ($EventData | Where-Object {$_.Name -eq 'GroupName'}).'#text'
       }
   }

5. Export results for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4733} | Export-Csv -Path "C:\Temp\GroupRemovals.csv" -NoTypeInformation

Cross-reference Event ID 4733 with other Active Directory events to build a complete picture of group membership changes.

1. Enable Advanced Audit Policy if not already configured:

   auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable

2. Query related security events for comprehensive analysis:

   # Get group management events from the last 24 hours
   $StartTime = (Get-Date).AddDays(-1)
   $GroupEvents = Get-WinEvent -FilterHashtable @{
       LogName='Security'
       Id=4728,4729,4732,4733,4756,4757
       StartTime=$StartTime
   } | Sort-Object TimeCreated

3. Check for corresponding Event ID 4732 (member added) events:

   $AddEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732}
   $RemoveEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4733}
   # Compare to identify accounts being moved between groups

4. Examine Directory Service logs on domain controllers:
   • Navigate to Applications and Services Logs → Directory Service
   • Look for events related to group modifications
   • Check for replication events if changes occurred on multiple DCs
5. Review the Security log on member servers for local group changes:

   Invoke-Command -ComputerName "Server01","Server02" -ScriptBlock {
       Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4733} -MaxEvents 10
   }

Set up proactive monitoring for Event ID 4733 to detect unauthorized group membership changes in real-time.

1. Create a custom Windows Event Forwarding subscription:
   • On your collector server, open Event Viewer
   • Right-click Subscriptions and select Create Subscription
   • Configure source computers and add this XPath query:

     *[System[(EventID=4733)]]

2. Set up PowerShell-based monitoring script:

   # Save as Monitor-GroupRemovals.ps1
   $Action = {
       $Event = $Event.SourceEventArgs.NewEvent
       $XML = [xml]$Event.ToXml()
       $EventData = $XML.Event.EventData.Data
       $GroupName = ($EventData | Where-Object {$_.Name -eq 'GroupName'}).'#text'
       $MemberName = ($EventData | Where-Object {$_.Name -eq 'MemberName'}).'#text'
       
       if ($GroupName -like '*Admin*' -or $GroupName -like '*Privileged*') {
           Send-MailMessage -To "security@company.com" -From "monitoring@company.com" `
               -Subject "Critical Group Removal Alert" `
               -Body "User $MemberName removed from $GroupName at $(Get-Date)" `
               -SmtpServer "mail.company.com"
       }
   }
   
   Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=4733" -Action $Action

3. Configure Windows Task Scheduler for regular auditing:
   • Create a scheduled task that runs the monitoring script
   • Set appropriate triggers based on your security requirements
   • Configure email notifications for critical group changes
4. Integrate with SIEM solutions:
   • Configure log forwarding to your SIEM platform
   • Create correlation rules for suspicious group modification patterns
   • Set up dashboards to visualize group membership trends

Perform comprehensive analysis of Event ID 4733 for security investigations and compliance reporting.

1. Create detailed forensic queries for incident investigation:

   # Advanced analysis script
   $StartDate = (Get-Date).AddDays(-30)
   $Events = Get-WinEvent -FilterHashtable @{
       LogName='Security'
       Id=4733
       StartTime=$StartDate
   }
   
   $Analysis = foreach ($Event in $Events) {
       $XML = [xml]$Event.ToXml()
       $EventData = $XML.Event.EventData.Data
       
       [PSCustomObject]@{
           TimeCreated = $Event.TimeCreated
           Computer = $Event.MachineName
           SubjectUserName = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           SubjectDomainName = ($EventData | Where-Object {$_.Name -eq 'SubjectDomainName'}).'#text'
           MemberName = ($EventData | Where-Object {$_.Name -eq 'MemberName'}).'#text'
           MemberSid = ($EventData | Where-Object {$_.Name -eq 'MemberSid'}).'#text'
           GroupName = ($EventData | Where-Object {$_.Name -eq 'GroupName'}).'#text'
           GroupDomain = ($EventData | Where-Object {$_.Name -eq 'GroupDomain'}).'#text'
           PrivilegeList = ($EventData | Where-Object {$_.Name -eq 'PrivilegeList'}).'#text'
       }
   }
   
   # Generate compliance report
   $Analysis | Export-Csv -Path "C:\Reports\GroupRemovalAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

2. Analyze patterns for security anomalies:

   # Identify unusual activity patterns
   $GroupedByUser = $Analysis | Group-Object SubjectUserName | Sort-Object Count -Descending
   $GroupedByGroup = $Analysis | Group-Object GroupName | Sort-Object Count -Descending
   $GroupedByTime = $Analysis | Group-Object {$_.TimeCreated.Hour} | Sort-Object Name
   
   # Flag potential security concerns
   $SuspiciousActivity = $Analysis | Where-Object {
       $_.GroupName -like '*Admin*' -and 
       $_.TimeCreated.Hour -lt 6 -or $_.TimeCreated.Hour -gt 22
   }

3. Cross-reference with user account changes:

   # Correlate with account management events
   $AccountEvents = Get-WinEvent -FilterHashtable @{
       LogName='Security'
       Id=4720,4722,4725,4726,4738
       StartTime=$StartDate
   }
   
   # Find accounts removed from groups shortly after creation/modification

4. Generate executive summary reports:
   • Create PowerBI dashboards showing group modification trends
   • Generate monthly compliance reports for audit teams
   • Implement automated reporting for SOX/HIPAA compliance
5. Document findings and recommendations:
   • Maintain incident response documentation
   • Update security policies based on analysis results
   • Provide training recommendations for administrators