Windows Event ID 4754 – Microsoft-Windows-Security-Auditing: Security-Enabled Universal Group Member Added

Start by examining the specific event details to understand what happened and who was involved.

1. Open Event Viewer on the domain controller where the event occurred
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4754 using the filter option in the Actions pane
4. Double-click the event to view detailed information including:
   • Subject: Account that performed the action
   • Group: Universal group that was modified
   • Member: Object that was added to the group
   • Process Information: Application that initiated the change
5. Note the timestamp, source workstation, and logon session details for correlation with other events
6. Check if the change was expected by comparing against change management records

Use PowerShell to analyze multiple Event ID 4754 occurrences and identify patterns or suspicious activity.

1. Open PowerShell as Administrator on a domain controller or management workstation
2. Query recent group membership additions:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4754} -MaxEvents 50 | ForEach-Object {
       $xml = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = $xml.Event.EventData.Data[0].'#text'
           SubjectDomainName = $xml.Event.EventData.Data[1].'#text'
           GroupName = $xml.Event.EventData.Data[5].'#text'
           GroupDomain = $xml.Event.EventData.Data[6].'#text'
           MemberName = $xml.Event.EventData.Data[8].'#text'
           MemberSid = $xml.Event.EventData.Data[9].'#text'
       }
   } | Format-Table -AutoSize

3. Filter for specific groups of interest:

   $TargetGroups = @('Domain Admins', 'Enterprise Admins', 'Schema Admins')
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4754} -MaxEvents 100 | Where-Object {
       $xml = [xml]$_.ToXml()
       $groupName = $xml.Event.EventData.Data[5].'#text'
       $TargetGroups -contains $groupName
   }

4. Export results for further analysis or reporting:

   $Results | Export-Csv -Path "C:\Temp\GroupMembershipChanges.csv" -NoTypeInformation

Investigate related events to build a complete picture of the group membership change activity.

1. Search for corresponding logon events around the same timeframe:

   $StartTime = (Get-Date).AddHours(-2)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{
       LogName='Security'
       Id=4624,4625,4648
       StartTime=$StartTime
       EndTime=$EndTime
   } | Where-Object {$_.Message -like '*SubjectUserName*'}

2. Check for Event ID 4728 (member added to security-enabled global group) and Event ID 4732 (member added to security-enabled local group) for comprehensive group change tracking
3. Look for Event ID 4756 (member removed from security-enabled universal group) to see if this was part of a membership transfer
4. Examine Event ID 4672 (special privileges assigned to new logon) to identify if administrative privileges were used
5. Cross-reference with Event ID 5136 (directory service object modified) for additional Active Directory change context
6. Use the Logon ID from Event 4754 to correlate with other activities in the same session:

   $LogonId = "0x3e7"  # Replace with actual Logon ID from Event 4754
   Get-WinEvent -FilterHashtable @{LogName='Security'} | Where-Object {
       $_.Message -like "*$LogonId*"
   } | Select-Object TimeCreated, Id, LevelDisplayName, Message

Validate the current state of the group and assess the security implications of the membership addition.

1. Check the current membership of the affected universal group:

   Get-ADGroupMember -Identity "GroupName" -Recursive | Select-Object Name, ObjectClass, SamAccountName, DistinguishedName

2. Verify the permissions and rights assigned to the universal group:

   Get-ADGroup -Identity "GroupName" -Properties MemberOf | Select-Object -ExpandProperty MemberOf | ForEach-Object {
       Get-ADGroup -Identity $_ | Select-Object Name, GroupScope, GroupCategory
   }

3. Check if the group has any special privileges or is nested in privileged groups:

   $Group = Get-ADGroup -Identity "GroupName" -Properties MemberOf
   $PrivilegedGroups = @('Domain Admins', 'Enterprise Admins', 'Schema Admins', 'Administrators')
   $Group.MemberOf | ForEach-Object {
       $ParentGroup = Get-ADGroup -Identity $_
       if ($PrivilegedGroups -contains $ParentGroup.Name) {
           Write-Warning "Group $($Group.Name) is member of privileged group: $($ParentGroup.Name)"
       }
   }

4. Audit the newly added member's existing group memberships:

   Get-ADUser -Identity "NewMemberName" -Properties MemberOf | Select-Object -ExpandProperty MemberOf | ForEach-Object {
       Get-ADGroup -Identity $_ | Select-Object Name, GroupScope, GroupCategory
   }

5. Review any Group Policy Objects that might be affected by this membership change

Set up proactive monitoring to detect and alert on future universal group membership changes.

1. Create a custom Windows Event Forwarding subscription to centralize Event ID 4754 from all domain controllers
2. Configure a PowerShell script for real-time monitoring:

   # Save as Monitor-UniversalGroupChanges.ps1
   Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.LogFile = 'Security' AND TargetInstance.EventCode = 4754" -Action {
       $Event = $Event.SourceEventArgs.NewEvent.TargetInstance
       $Message = "Universal Group Member Added: $($Event.Message)"
       Write-EventLog -LogName Application -Source "GroupMonitor" -EventId 1001 -Message $Message -EntryType Information
       # Add email notification or SIEM integration here
   }

3. Set up Windows Task Scheduler to run monitoring scripts at regular intervals
4. Create custom Event Viewer views for security teams:
   • Filter: Event ID 4754, 4756 (member removed), 4728, 4732
   • Group by: Group Name or Subject User Name
   • Time range: Last 24 hours or 7 days
5. Configure SIEM integration using Windows Event Forwarding or log shipping agents
6. Implement automated response procedures for high-risk group changes:

   # Example automated response
   if ($GroupName -in @('Domain Admins', 'Enterprise Admins')) {
       Send-MailMessage -To "security@company.com" -Subject "ALERT: Privileged Group Modified" -Body $AlertMessage
       # Optionally disable the account pending investigation
       # Disable-ADAccount -Identity $SubjectUserName
   }