azureblog.co.uk
← cd ~/events
// events/4757 · Groups

Event ID 4757A member was removed from a security-enabled universal group

A member was removed from a universal security group. Logged on domain controllers only; the fields match event 4733 apart from the group type.

LogSecurity
SourceMicrosoft-Windows-Security-Auditing
AreaGroups

What to check

Alert on changes to privileged groups such as Domain Admins, Enterprise Admins and Schema Admins, and confirm the change was approved.

Find it with PowerShell

Run on the machine that logs it, as an administrator.

powershell2 lines
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4757 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.

kql5 lines
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4757
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated desc

Related Groups events

  • Event ID 4732: A member was added to a security-enabled local group
  • Event ID 4733: A member was removed from a security-enabled local group
  • Event ID 4728: A member was added to a security-enabled global group
  • Event ID 4729: A member was removed from a security-enabled global group
  • Event ID 4756: A member was added to a security-enabled universal group

Search all 123 event IDs →

Sources