Event ID 4728 — Adding to a global security group

One member was added to a global security group.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Attribution of duties
• Adding to a trade group
• Elevation of privileges

Verifications to be carried out

1. Identify Member Name and Group Name
2. Check who made the, add
3. Pay particular attention to privileged groups

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728} -MaxEvents 30

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.