Windows Event ID 4753 – Microsoft-Windows-Security-Auditing: Security-Enabled Global Group Member Removed

Start by examining the specific details of Event ID 4753 to understand what group membership change occurred.

1. Open Event Viewer on the domain controller where the event was logged
2. Navigate to Windows Logs → Security
3. Filter the log for Event ID 4753 using Filter Current Log → Event IDs: 4753
4. Double-click the event to view detailed information including:
   • Subject: Account that performed the removal
   • Member: Account that was removed from the group
   • Group: Target security group information
   • Additional Information: Privileges used for the operation
5. Note the timestamp, source workstation, and logon ID for correlation with other events

Use PowerShell to efficiently search and analyze Event ID 4753 across multiple domain controllers or time periods.

1. Open PowerShell as Administrator on a domain controller or management workstation
2. Query recent 4753 events with basic filtering:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4753} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Search for specific group membership removals:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4753; StartTime=(Get-Date).AddDays(-7)}
   $Events | ForEach-Object {
       $EventXML = [xml]$_.ToXml()
       $Subject = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
       $Member = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'MemberName'} | Select-Object -ExpandProperty '#text'
       $Group = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           Subject = $Subject
           RemovedMember = $Member
           FromGroup = $Group
       }
   }

4. Export results for analysis:

   $Results | Export-Csv -Path "C:\Temp\GroupMembershipRemovals.csv" -NoTypeInformation

Investigate Event ID 4753 in context with related security events to build a complete picture of the group membership change.

1. Identify the logon session that performed the group modification:

   $Event4753 = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4753} -MaxEvents 1
   $EventXML = [xml]$Event4753.ToXml()
   $LogonId = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectLogonId'} | Select-Object -ExpandProperty '#text'
   Write-Host "Logon ID: $LogonId"

2. Find the corresponding logon event (4624) for the same session:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} | Where-Object {
       $LogonXML = [xml]$_.ToXml()
       $SessionLogonId = $LogonXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetLogonId'} | Select-Object -ExpandProperty '#text'
       $SessionLogonId -eq $LogonId
   } | Select-Object TimeCreated, @{Name='LogonType';Expression={([xml]$_.ToXml()).Event.EventData.Data | Where-Object {$_.Name -eq 'LogonType'} | Select-Object -ExpandProperty '#text'}}, @{Name='WorkstationName';Expression={([xml]$_.ToXml()).Event.EventData.Data | Where-Object {$_.Name -eq 'WorkstationName'} | Select-Object -ExpandProperty '#text'}}

3. Check for other group modifications in the same timeframe:

   $TimeWindow = $Event4753.TimeCreated
   $StartTime = $TimeWindow.AddMinutes(-5)
   $EndTime = $TimeWindow.AddMinutes(5)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728,4729,4732,4733,4756,4757; StartTime=$StartTime; EndTime=$EndTime} | Format-Table TimeCreated, Id, @{Name='EventType';Expression={switch($_.Id){4728{'User added to global group'};4729{'User removed from global group'};4732{'User added to local group'};4733{'User removed from local group'};4756{'User added to universal group'};4757{'User removed from universal group'}}}}

When Event ID 4753 indicates potential unauthorized group membership removal, perform detailed forensic analysis.

1. Verify the legitimacy of the group membership change by checking recent change requests or tickets
2. Examine the subject account that performed the removal:

   $Event4753 = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4753} -MaxEvents 1
   $EventXML = [xml]$Event4753.ToXml()
   $SubjectAccount = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
   $SubjectDomain = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectDomainName'} | Select-Object -ExpandProperty '#text'
   Get-ADUser -Identity $SubjectAccount -Server $SubjectDomain -Properties LastLogonDate, PasswordLastSet, MemberOf | Select-Object Name, LastLogonDate, PasswordLastSet, @{Name='Groups';Expression={$_.MemberOf -join '; '}}

3. Check if the removed user still exists and review their current group memberships:

   $RemovedMember = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'MemberName'} | Select-Object -ExpandProperty '#text'
   try {
       $User = Get-ADUser -Identity $RemovedMember -Properties MemberOf, LastLogonDate
       Write-Host "User still exists. Current groups: $($User.MemberOf -join '; ')"
       Write-Host "Last logon: $($User.LastLogonDate)"
   } catch {
       Write-Host "User account no longer exists or cannot be found"
   }

4. Audit the target group's current membership and recent changes:

   $TargetGroup = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
   $Group = Get-ADGroup -Identity $TargetGroup -Properties Members, Description
   Write-Host "Group: $($Group.Name)"
   Write-Host "Description: $($Group.Description)"
   Write-Host "Current member count: $($Group.Members.Count)"
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728,4753; StartTime=(Get-Date).AddDays(-30)} | Where-Object {
       $XML = [xml]$_.ToXml()
       $GroupName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
       $GroupName -eq $TargetGroup
   } | Select-Object TimeCreated, Id, @{Name='Action';Expression={if($_.Id -eq 4728){'Added'}else{'Removed'}}}

Set up proactive monitoring for Event ID 4753 to detect and respond to group membership changes in real-time.

1. Create a custom Event Viewer view for group membership monitoring:
   • Open Event Viewer → Custom Views → Create Custom View
   • Set Event level: Information
   • Set Event logs: Security
   • Set Event IDs: 4728,4729,4732,4733,4753,4756,4757
   • Save as "Group Membership Changes"
2. Configure Windows Event Forwarding to centralize group change events:

   # On collector server
   wecutil cs GroupMembershipSubscription.xml
   
   # Sample subscription XML content:
   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>GroupMembershipChanges</SubscriptionId>
       <SubscriptionType>SourceInitiated</SubscriptionType>
       <Description>Forward group membership change events</Description>
       <Enabled>true</Enabled>
       <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
       <ConfigurationMode>Normal</ConfigurationMode>
       <Query>
           <![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[(EventID=4728 or EventID=4729 or EventID=4732 or EventID=4733 or EventID=4753 or EventID=4756 or EventID=4757)]]</Select>
               </Query>
           </QueryList>
           ]]>
       </Query>
   </Subscription>

3. Create PowerShell monitoring script for critical groups:

   # Monitor-CriticalGroups.ps1
   $CriticalGroups = @('Domain Admins', 'Enterprise Admins', 'Schema Admins')
   $LastCheck = (Get-Date).AddMinutes(-5)
   
   foreach ($Group in $CriticalGroups) {
       $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4753; StartTime=$LastCheck} | Where-Object {
           $XML = [xml]$_.ToXml()
           $TargetGroup = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           $TargetGroup -like "*$Group*"
       }
       
       if ($Events) {
           foreach ($Event in $Events) {
               $XML = [xml]$Event.ToXml()
               $Subject = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
               $Member = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'MemberName'} | Select-Object -ExpandProperty '#text'
               
               # Send alert (customize as needed)
               Write-Warning "CRITICAL: User $Member removed from $Group by $Subject at $($Event.TimeCreated)"
               # Add email notification, SIEM integration, etc.
           }
       }
   }

4. Schedule the monitoring script to run every 5 minutes using Task Scheduler