Windows Event ID 4734 – Microsoft-Windows-Security-Auditing: Security-Enabled Local Group Member Removed

Start by examining the specific details of the Event ID 4734 occurrence to understand what happened.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the right pane
4. Enter 4734 in the Event IDs field and click OK
5. Double-click on a recent Event ID 4734 entry to view details
6. Review the following key fields in the event description:
   • Subject: Who performed the removal (Account Name, Account Domain, Logon ID)
   • Group: Which group was modified (Group Name, Group Domain, Group SID)
   • Member: Which account was removed (Member Name, Member SID)
7. Note the timestamp and correlate with any known administrative activities

Use PowerShell to programmatically query and analyze Event ID 4734 occurrences across multiple systems or time periods.

1. Open PowerShell as Administrator
2. Query recent Event ID 4734 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4734} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. For more detailed analysis, extract specific fields:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4734} -MaxEvents 20 | ForEach-Object {
       $xml = [xml]$_.ToXml()
       $eventData = $xml.Event.EventData.Data
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = ($eventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           GroupName = ($eventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
           MemberName = ($eventData | Where-Object {$_.Name -eq 'MemberName'}).'#text'
           MemberSid = ($eventData | Where-Object {$_.Name -eq 'MemberSid'}).'#text'
       }
   }

4. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4734; StartTime=$StartTime; EndTime=$EndTime}

5. Export results to CSV for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4734} -MaxEvents 100 | Export-Csv -Path "C:\Temp\GroupRemovals.csv" -NoTypeInformation

Verify current group membership and investigate whether the removal was authorized and expected.

1. Check current membership of the affected group using PowerShell:

   Get-LocalGroupMember -Group "GroupName"

2. For domain groups, use Active Directory cmdlets:

   Get-ADGroupMember -Identity "GroupName" | Select-Object Name, SamAccountName, ObjectClass

3. Review group membership history by querying related events:

   # Look for both additions (4732) and removals (4734)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732,4734} -MaxEvents 100 | Where-Object {$_.Message -like "*GroupName*"} | Sort-Object TimeCreated

4. Check if the removal was part of a larger administrative action by examining events around the same time:

   $EventTime = (Get-Date "2026-03-18 10:30:00")
   $TimeWindow = 300 # 5 minutes
   Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$EventTime.AddSeconds(-$TimeWindow); EndTime=$EventTime.AddSeconds($TimeWindow)} | Where-Object {$_.Id -in @(4732,4733,4734,4735)}

5. Verify the subject account that performed the removal has appropriate permissions
6. Document findings and determine if the change was authorized

Set up comprehensive monitoring to track future group membership changes and establish baselines for normal activity.

1. Verify that Object Access auditing is enabled through Group Policy:
   • Open Group Policy Management Console
   • Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Expand Account Management and ensure Audit Security Group Management is set to Success and Failure
2. Configure advanced audit settings via command line:

   auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable

3. Create a scheduled task to monitor for suspicious group changes:

   # Create a PowerShell script that runs every 15 minutes
   $ScriptBlock = {
       $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4734; StartTime=(Get-Date).AddMinutes(-15)} -ErrorAction SilentlyContinue
       if ($Events) {
           $Events | ForEach-Object {
               # Add your alerting logic here
               Write-EventLog -LogName Application -Source "GroupMonitor" -EventId 1001 -Message "Group member removal detected: $($_.Message)"
           }
       }
   }
   # Register the scheduled task
   Register-ScheduledTask -TaskName "MonitorGroupRemovals" -Trigger (New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 15) -Once -At (Get-Date)) -Action (New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-WindowStyle Hidden -Command $ScriptBlock")

4. Set up Windows Event Forwarding (WEF) to centralize security logs from multiple systems
5. Configure SIEM integration if available to correlate group changes with other security events

Perform detailed forensic analysis when Event ID 4734 indicates potential security incidents or unauthorized changes.

1. Create a forensic timeline of all related events:

   # Collect comprehensive event data
   $StartDate = (Get-Date).AddDays(-30)
   $Events = @()
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4648,4672,4732,4733,4734,4735; StartTime=$StartDate} -ErrorAction SilentlyContinue
   $Events += Get-WinEvent -FilterHashtable @{LogName='System'; Id=7034,7035,7036; StartTime=$StartDate} -ErrorAction SilentlyContinue
   $Events | Sort-Object TimeCreated | Export-Csv -Path "C:\Forensics\SecurityTimeline.csv" -NoTypeInformation

2. Analyze logon sessions associated with the subject account:

   # Find logon events for the account that made the change
   $SubjectAccount = "DOMAIN\Username" # Replace with actual account
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625} | Where-Object {$_.Message -like "*$SubjectAccount*"} | Select-Object TimeCreated, Id, Message

3. Check for privilege escalation events (Event ID 4672) around the time of group changes:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-24)} | Format-Table TimeCreated, Message -Wrap

4. Examine process creation events if Process Tracking is enabled:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.Message -like "*net.exe*" -or $_.Message -like "*powershell*"} | Select-Object TimeCreated, Message

5. Document all findings and create an incident report including:
   • Timeline of events leading to the group change
   • Source of the change (user, process, system)
   • Impact assessment of the removed member
   • Recommendations for remediation or policy changes
6. If malicious activity is suspected, preserve evidence and consider isolating affected systems