Windows Event ID 4764 – Microsoft-Windows-Security-Auditing: Group Member Added

Start by examining the specific event details to understand what group membership change occurred and who initiated it.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4764 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4764 in the Event IDs field and click OK
5. Double-click on a 4764 event to view detailed information including:
   • Subject: Who performed the action (account name and SID)
   • Member: Which user was added to the group
   • Group: Target group name and SID
   • Privileges: Security privileges used for the operation
6. Note the timestamp and correlate with other administrative activities
7. Check the Process Information section to identify which application or tool was used

Use PowerShell to efficiently search and analyze Event ID 4764 occurrences across your environment.

1. Open PowerShell as Administrator
2. Query recent group membership additions:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4764} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='Message';Expression={$_.Message.Split('`n')[0..10] -join '`n'}}

3. Filter events for specific groups (replace 'Domain Admins' with your target group):

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4764} | Where-Object {$_.Message -like '*Domain Admins*'} | Select-Object TimeCreated, @{Name='Details';Expression={$_.Message}}

4. Extract structured data from events:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4764} -MaxEvents 100
   foreach ($Event in $Events) {
       $XML = [xml]$Event.ToXml()
       $EventData = $XML.Event.EventData.Data
       [PSCustomObject]@{
           TimeCreated = $Event.TimeCreated
           SubjectUserName = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           MemberName = ($EventData | Where-Object {$_.Name -eq 'MemberName'}).'#text'
           GroupName = ($EventData | Where-Object {$_.Name -eq 'GroupName'}).'#text'
       }
   }

5. Export results for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4764} -MaxEvents 1000 | Export-Csv -Path "C:\Temp\GroupMembershipChanges.csv" -NoTypeInformation

Ensure proper audit policy configuration to capture all group membership changes consistently.

1. Open Group Policy Management Console or Local Group Policy Editor (gpedit.msc)
2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Account Management and locate Audit Security Group Management
4. Configure the policy to Success and Failure for comprehensive logging
5. Verify current audit settings via PowerShell:

   auditpol /get /category:"Account Management" /subcategory:"Security Group Management"

6. Apply settings immediately using:

   gpupdate /force

7. Test the configuration by adding a test user to a group and verifying Event ID 4764 appears
8. For domain environments, configure this policy at the Domain Controllers OU level
9. Monitor audit policy changes using Event ID 4719 to detect unauthorized modifications

Set up proactive monitoring to detect and respond to critical group membership changes in real-time.

1. Create a PowerShell script for continuous monitoring:

   # Monitor-GroupChanges.ps1
   $SensitiveGroups = @('Domain Admins', 'Enterprise Admins', 'Schema Admins', 'Administrators')
   $LastCheck = (Get-Date).AddMinutes(-5)
   
   while ($true) {
       $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4764; StartTime=$LastCheck} -ErrorAction SilentlyContinue
       
       foreach ($Event in $Events) {
           $XML = [xml]$Event.ToXml()
           $GroupName = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'GroupName'}).'#text'
           
           if ($SensitiveGroups -contains $GroupName) {
               # Send alert - customize notification method
               Write-Host "ALERT: User added to $GroupName at $($Event.TimeCreated)" -ForegroundColor Red
               # Add email notification, SIEM integration, etc.
           }
       }
       
       $LastCheck = Get-Date
       Start-Sleep -Seconds 300  # Check every 5 minutes
   }

2. Configure Windows Task Scheduler to run the monitoring script:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-GroupChanges.ps1"
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   $Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
   Register-ScheduledTask -TaskName "GroupMembershipMonitor" -Action $Action -Trigger $Trigger -Principal $Principal

3. Set up Event Log subscriptions for centralized collection:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>GroupMembershipChanges</SubscriptionId>
       <Query>
           <![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[EventID=4764]]</Select>
               </Query>
           </QueryList>
           ]]>
       </Query>
   </Subscription>

4. Configure SIEM integration using Windows Event Forwarding or direct log shipping

Perform detailed forensic analysis to investigate suspicious group membership changes and establish complete attack timelines.

1. Collect related events for comprehensive analysis:

   # Collect all group management events
   $StartTime = (Get-Date).AddDays(-7)
   $GroupEvents = @(4728, 4729, 4732, 4733, 4756, 4757, 4764, 4765)
   
   $AllEvents = foreach ($EventId in $GroupEvents) {
       Get-WinEvent -FilterHashtable @{LogName='Security'; Id=$EventId; StartTime=$StartTime} -ErrorAction SilentlyContinue
   }
   
   $AllEvents | Sort-Object TimeCreated | Export-Csv -Path "C:\Temp\GroupManagementTimeline.csv" -NoTypeInformation

2. Correlate with logon events to establish user context:

   # Find logon sessions related to group changes
   $LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$StartTime}
   $GroupChangeEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4764; StartTime=$StartTime}
   
   foreach ($GroupEvent in $GroupChangeEvents) {
       $XML = [xml]$GroupEvent.ToXml()
       $LogonId = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectLogonId'}).'#text'
       
       $RelatedLogon = $LogonEvents | Where-Object {
           $LogonXML = [xml]$_.ToXml()
           ($LogonXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetLogonId'}).'#text' -eq $LogonId
       } | Select-Object -First 1
       
       if ($RelatedLogon) {
           Write-Host "Group change at $($GroupEvent.TimeCreated) linked to logon at $($RelatedLogon.TimeCreated)"
       }
   }

3. Analyze process execution context:

   # Extract process information from events
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4764} -MaxEvents 100 | ForEach-Object {
       $XML = [xml]$_.ToXml()
       $ProcessName = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessName'}).'#text'
       $ProcessId = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessId'}).'#text'
       
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           ProcessName = $ProcessName
           ProcessId = $ProcessId
           GroupName = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'GroupName'}).'#text'
       }
   } | Group-Object ProcessName | Sort-Object Count -Descending

4. Generate comprehensive forensic report:

   # Create detailed analysis report
   $Report = @"
   Group Membership Change Analysis Report
   Generated: $(Get-Date)
   
   Summary of Changes (Last 7 Days):
   "@
   
   $GroupStats = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4764; StartTime=(Get-Date).AddDays(-7)} | 
       Group-Object @{Expression={([xml]$_.ToXml()).Event.EventData.Data | Where-Object {$_.Name -eq 'GroupName'} | Select-Object -ExpandProperty '#text'}} | 
       Sort-Object Count -Descending
   
   foreach ($Stat in $GroupStats) {
       $Report += "`n$($Stat.Name): $($Stat.Count) additions"
   }
   
   $Report | Out-File -FilePath "C:\Temp\GroupChangeAnalysis.txt"