Event ID 4732 — Adding to a local security group

One member was added to a local security group.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Adding,a local administrator
• Applicative delegation
• Unauthorised amendment

Verifications to be carried out

1. Identify target group
2. Control the user added….
3. Check author and justification….

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732} -MaxEvents 30

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.