azureblog.co.uk
← cd ~/events
// events/4733 · Groups

Event ID 4733A member was removed from a security-enabled local group

A member was removed from a local security group (or a domain local group on a DC).

LogSecurity
SourceMicrosoft-Windows-Security-Auditing
AreaGroups

What to check

Alert on changes to high-value groups such as the built-in Administrators group.

Find it with PowerShell

Run on the machine that logs it, as an administrator.

powershell2 lines
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4733 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.

kql5 lines
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4733
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated desc

Related Groups events

  • Event ID 4732: A member was added to a security-enabled local group
  • Event ID 4728: A member was added to a security-enabled global group
  • Event ID 4729: A member was removed from a security-enabled global group
  • Event ID 4756: A member was added to a security-enabled universal group
  • Event ID 4757: A member was removed from a security-enabled universal group

Search all 123 event IDs →

Sources