Windows Event ID 4756 – Microsoft-Windows-Security-Auditing: Universal Security Group Member Added

Start by examining the event details to understand what group was modified and by whom.

1. Open Event Viewer on the domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4756 using the filter option
4. Double-click the event to view details
5. Review the Subject section to identify who made the change
6. Check the Group section for the target universal group details
7. Examine the Member section to see what account was added
8. Note the timestamp and correlate with any approved change requests

Key fields to examine:

• Subject Account Name: Who performed the action
• Group Name: Which universal group was modified
• Member Name: What account was added
• Member SID: Security identifier of the added member

Use PowerShell to query and analyze Event ID 4756 across multiple domain controllers.

1. Open PowerShell as Administrator
2. Query recent group membership additions:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4756} -MaxEvents 50 | Select-Object TimeCreated, @{Name='Subject';Expression={($_.Properties[1].Value)}}, @{Name='GroupName';Expression={($_.Properties[5].Value)}}, @{Name='MemberName';Expression={($_.Properties[8].Value)}}

3. Filter for specific universal groups:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4756} | Where-Object {$_.Message -like '*Enterprise Admins*'} | Format-Table TimeCreated, Id, LevelDisplayName

4. Query across multiple domain controllers:

$DCs = Get-ADDomainController -Filter *
foreach ($DC in $DCs) {
    Write-Host "Checking $($DC.Name)"
    Get-WinEvent -ComputerName $DC.Name -FilterHashtable @{LogName='Security'; Id=4756; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
}

5. Export results for analysis:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4756; StartTime=(Get-Date).AddDays(-30)} | Export-Csv -Path "C:\Temp\GroupMembershipChanges.csv" -NoTypeInformation

Validate the current group membership and assess the security impact of the addition.

1. Check current universal group membership:

Get-ADGroup -Identity "GroupName" -Properties Members | Select-Object -ExpandProperty Members | Get-ADObject

2. Verify the added account details:

Get-ADUser -Identity "AddedUserName" -Properties MemberOf, LastLogonDate, PasswordLastSet | Select-Object Name, SamAccountName, MemberOf, LastLogonDate, PasswordLastSet

3. Check group permissions across the forest:

$Group = Get-ADGroup -Identity "GroupName"
Get-ADObject -Filter {nTSecurityDescriptor -like "*$($Group.SID)*"} -Properties nTSecurityDescriptor

4. Review nested group memberships:

Get-ADPrincipalGroupMembership -Identity "AddedUserName" | Where-Object {$_.GroupScope -eq "Universal"}

5. Validate against approved access lists:

• Compare current membership with documented authorized users
• Check if the addition follows change management procedures
• Verify business justification for the group membership

Perform detailed forensic analysis when suspicious group membership changes are detected.

1. Correlate with logon events for the subject account:

$SubjectSID = "S-1-5-21-..."
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=(Get-Date).AddHours(-2)} | Where-Object {$_.Message -like "*$SubjectSID*"}

2. Check for related security events:

$TimeWindow = (Get-Date).AddMinutes(-30)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728,4729,4732,4733,4756,4757; StartTime=$TimeWindow} | Sort-Object TimeCreated

3. Review authentication logs on the source system:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648} | Where-Object {$_.Properties[5].Value -eq "SubjectAccountName"}

4. Examine process creation events if available:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.Message -like "*dsa.msc*" -or $_.Message -like "*powershell*"}

5. Check for privilege escalation indicators:

• Review if the subject account recently gained administrative privileges
• Verify the account's normal access patterns and responsibilities
• Check for concurrent suspicious activities from the same account
• Validate the source IP address and authentication method used

6. Document findings and take corrective action:

• Remove unauthorized group membership if confirmed malicious
• Reset compromised account passwords
• Implement additional monitoring for the affected groups
• Update security policies to prevent similar incidents

Set up proactive monitoring to detect and respond to universal group membership changes in real-time.

1. Create a PowerShell monitoring script:

# Monitor-UniversalGroupChanges.ps1
$SensitiveGroups = @("Enterprise Admins", "Schema Admins", "Domain Admins")
$LastCheck = (Get-Date).AddMinutes(-5)

foreach ($Group in $SensitiveGroups) {
    $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4756; StartTime=$LastCheck} | Where-Object {$_.Message -like "*$Group*"}
    if ($Events) {
        Send-MailMessage -To "security@company.com" -Subject "ALERT: $Group membership changed" -Body $Events.Message -SmtpServer "mail.company.com"
    }
}

2. Configure Windows Event Forwarding (WEF):

• Set up a central log collector for all domain controllers
• Configure subscription to forward Event ID 4756
• Create custom views for universal group changes

3. Implement SIEM integration:

# Export events in JSON format for SIEM ingestion
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4756} -MaxEvents 100 | ConvertTo-Json | Out-File "C:\Logs\GroupChanges.json"

4. Set up scheduled task for monitoring:

$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-UniversalGroupChanges.ps1"
$Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
Register-ScheduledTask -TaskName "MonitorUniversalGroups" -Action $Action -Trigger $Trigger -RunLevel Highest

5. Create custom Event Viewer views:

• Open Event Viewer and create a custom view
• Filter for Event ID 4756 from Security log
• Save the view as "Universal Group Changes"
• Configure email notifications through Task Scheduler