Windows Event ID 4752 – Microsoft-Windows-Security-Auditing: A Member Was Added to a Security-Disabled Global Group

Open Event Viewer and navigate to the Security log to examine the event details:

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 4752 in the Event IDs field and click OK
5. Double-click on an Event ID 4752 entry to view details
6. Review the following key fields in the event description:
   • Subject: Account that made the change
   • Member: Account that was added to the group
   • Group: Target group name and domain
   • Additional Information: Privileges used for the operation

The event XML view provides structured data for automated processing and contains SID values for precise identification.

Use PowerShell to query and analyze Event ID 4752 occurrences across multiple domain controllers:

# Query recent 4752 events from local Security log
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4752} -MaxEvents 50 | 
  Select-Object TimeCreated, Id, LevelDisplayName, Message

# Extract specific details from event messages
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4752} -MaxEvents 10 | 
  ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
      TimeCreated = $_.TimeCreated
      SubjectUserName = $xml.Event.EventData.Data[1].'#text'
      SubjectDomainName = $xml.Event.EventData.Data[2].'#text'
      MemberName = $xml.Event.EventData.Data[6].'#text'
      GroupName = $xml.Event.EventData.Data[8].'#text'
      GroupDomain = $xml.Event.EventData.Data[9].'#text'
    }
  }

# Query events from remote domain controller
Get-WinEvent -ComputerName 'DC01.contoso.com' -FilterHashtable @{LogName='Security'; Id=4752; StartTime=(Get-Date).AddDays(-7)}

This approach enables automated monitoring and reporting of group membership changes across your Active Directory infrastructure.

Ensure proper audit policy configuration to capture Event ID 4752 consistently:

1. Open Group Policy Management Console and edit the Default Domain Controllers Policy
2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Audit Policies → Account Management
4. Double-click Audit Distribution Group Management
5. Check Configure the following audit events and select Success
6. Click OK and run gpupdate /force on domain controllers

Verify the policy is applied correctly:

# Check current audit policy settings
auditpol /get /subcategory:"Distribution Group Management"

# Set audit policy via command line if needed
auditpol /set /subcategory:"Distribution Group Management" /success:enable

This ensures all distribution group membership changes generate audit events for compliance and security monitoring.

Correlate Event ID 4752 with related events to build a complete picture of group modifications:

# Find all group-related events for a specific timeframe
$StartTime = (Get-Date).AddHours(-24)
$GroupEvents = Get-WinEvent -FilterHashtable @{
  LogName='Security'
  Id=4752,4753,4756,4757
  StartTime=$StartTime
} | Sort-Object TimeCreated

# Analyze patterns in group changes
$GroupEvents | Group-Object Id | Select-Object Name, Count

# Check for suspicious activity patterns
$GroupEvents | Where-Object {$_.Id -eq 4752} | 
  ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
      Time = $_.TimeCreated
      User = $xml.Event.EventData.Data[1].'#text'
      AddedMember = $xml.Event.EventData.Data[6].'#text'
      Group = $xml.Event.EventData.Data[8].'#text'
    }
  } | Group-Object User | Where-Object Count -gt 10

Cross-reference with Active Directory to verify current group membership:

# Verify current group membership
Get-ADGroupMember -Identity "GroupName" | Select-Object Name, SamAccountName, ObjectClass

# Check group properties
Get-ADGroup -Identity "GroupName" -Properties *

Create automated monitoring solutions to track and alert on Event ID 4752 occurrences:

# PowerShell script for continuous monitoring
$Action = {
  $Event = $Event.SourceEventArgs.NewEvent
  $xml = [xml]$Event.ToXml()
  $GroupName = $xml.Event.EventData.Data[8].'#text'
  $AddedMember = $xml.Event.EventData.Data[6].'#text'
  $User = $xml.Event.EventData.Data[1].'#text'
  
  # Send alert for critical groups
  if ($GroupName -match "Executive|Finance|HR") {
    Send-MailMessage -To "security@company.com" -From "monitoring@company.com" `
      -Subject "Critical Group Change Alert" `
      -Body "User $AddedMember was added to $GroupName by $User at $(Get-Date)"
  }
}

# Register event watcher
Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=4752" -Action $Action

Configure Windows Event Forwarding for centralized collection:

1. On collector server, run wecutil qc to configure Windows Event Collector
2. Create subscription configuration file:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>GroupChanges</SubscriptionId>
  <Query>
    <![CDATA[<QueryList><Query Id="0"><Select Path="Security">*[System[EventID=4752]]</Select></Query></QueryList>]]>
  </Query>
</Subscription>

Deploy the subscription: wecutil cs GroupChanges.xml