Active Directory Group Audit Reports
The Entralyzer application makes it easy to track changes to groups, who was added, removed to groups, moved, renamed and track modifications.
Reports located at Audit > Active Directory > Group Audit
| Event ID | Report Name | Description |
|---|---|---|
| 4727 | Created Groups | Global Security group created |
| 4731 | Created Groups | Local Security group created |
| 4754 | Created Groups | Universal Security group created |
| 4749 | Created Groups | Global Distribution group created |
| 4744 | Created Groups | Local Distribution group created |
| 4759 | Created Groups | Universal Distribution group created |
| 4730 | Deleted Groups | Global Security group deleted |
| 4734 | Deleted Groups | Local Security group deleted |
| 4758 | Deleted Groups | Universal Security group deleted |
| 4753 | Deleted Groups | Global Distribution group deleted |
| 4748 | Deleted Groups | Local Distribution group deleted |
| 4763 | Deleted Groups | Universal Distribution group deleted |
| 4728 | Domain Admins Membership Changes | A member was added |
| 4729 | Domain Admins Membership Changes | A member was removed |
| 5136 | Group Attribute New and Old Value | An object was modified |
| 4728 | Group Membership Changes | Member added to Global Security group |
| 4732 | Group Membership Changes | Member added to Local Security group |
| 4756 | Group Membership Changes | Member added to Universal Security group |
| 4751 | Group Membership Changes | Member added to Global Distribution group |
| 4760 | Group Membership Changes | Member added to Local Distribution group |
| 4746 | Group Membership Changes | Member added to Universal Distribution group |
| 4729 | Group Membership Changes | Member removed from Global Security group |
| 4733 | Group Membership Changes | Member removed from Local Security group |
| 4757 | Group Membership Changes | Member removed from Universal Security group |
| 4752 | Group Membership Changes | Member removed from Global Distribution group |
| 4747 | Group Membership Changes | Member removed from Local Distribution group |
| 4762 | Group Membership Changes | Member removed from Universal Distribution group |
| 5136 | Modified Groups | An Active Directory group was modified |
| 5139 | Moved Groups | An Active Directory group was moved |
| 4728 | Privileged Groups Membership Changes | Member added to Global Security group |
| 4732 | Privileged Groups Membership Changes | Member added to Local Security group |
| 4756 | Privileged Groups Membership Changes | Member added to Universal Security group |
| 4751 | Privileged Groups Membership Changes | Member added to Global Distribution group |
| 4760 | Privileged Groups Membership Changes | Member added to Local Distribution group |
| 4746 | Privileged Groups Membership Changes | Member added to Universal Distribution group |
| 4729 | Privileged Groups Membership Changes | Member removed from Global Security group |
| 4733 | Privileged Groups Membership Changes | Member removed from Local Security group |
| 4757 | Privileged Groups Membership Changes | Member removed from Universal Security group |
| 4752 | Privileged Groups Membership Changes | Member removed from Global Distribution group |
| 4747 | Privileged Groups Membership Changes | Member removed from Local Distribution group |
| 4762 | Privileged Groups Membership Changes | Member removed from Universal Distribution group |
| 5138 | Recently Undeleted Groups | Group restored from Recycle Bin |
| 4781 | Renamed Groups | Group sAMAccountName or UPN has changed |
Note: Privileged Groups Membership Changes monitors the following groups:
- Domain Admins
- Enterprise Admins
- Administrators
- Schema Admins
- Account Operators
- Server Operators
- Backup Operators
- Print Operators
- DNSAdmins
- Cert Publishers
- DHCP Administrators
- Event Log Readers
- Group Policy Creator Owners
- Enterprise Key Admins
- RAS and IAS Server
- Hyper-V Administrators