4732
A member was added to a security-enabled local group
- Log: Security
- Source: Microsoft-Windows-Security-Auditing
- Account changes
- Warning
What it means
Someone was added to a local group on a computer, most importantly the local Administrators group.
Why it matters
Granting local admin rights is a common step before installing malware or moving to other machines.
What to do
- Review additions to the local Administrators group.
- Consider Windows LAPS and removing standing admin rights.
Find it with PowerShell
Get-WinEvent -MaxEvents 20 -FilterHashtable @{
LogName = 'Security'; Id = 4732
} | Select-Object TimeCreated, ProviderName, MessageAdd -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.
Source
Seeing a lot of these? We can investigate, or alert you automatically through our monitoring.
Talk to us