Skip to content
References
Windows Event Log
4728

Windows Event ID 4728: A member was added to a security-enabled global group

Written when a member is added to a security-enabled global group (a domain group). Addition to a privileged domain group such as Domain Admins leads directly to privilege escalation, making it a top-tier account-management event.

Overview

The subcategory is Audit Security Group Management. It is generated when a new member is added to a global group, recorded only on domain controllers. One event appears per added member. It is the domain counterpart to the local-group 4732, with an important difference: the Member\Account Name is recorded as a distinguished name (DN) (for example, CN=Auditor,CN=Users,DC=contoso,DC=local).

How it is triggered

  • Member addition via net group "Domain Admins" <user> /add /domain, Active Directory Users and Computers (ADUC), Add-ADGroupMember, and so on.

Security review points

  • Addition to a privileged domain group is most important. Adding to Domain Admins, Group Policy Creator Owners, or DnsAdmins grants domain-wide privileges, a hallmark of privilege escalation and persistence.
  • A sequence of account creation 4720 then addition to Domain Admins 4728 strongly suggests creating a backdoor domain administrator account.
  • Confirm the added target and adding subject are as expected. The forest-wide Enterprise Admins / Schema Admins are universal groups, so they appear as a separate event 4756; addition to a local group is 4732.

Notes for log review

  • Because the member is recorded as a DN, it looks hard to read at first. Resolve the CN= portion to make clear which account was added.
  • It also occurs on DCs as a legitimate privilege grant. Narrow by group name (whether privileged) and normal patterns of target and subject, and alert on additions to Domain Admins at high priority in particular.
  • Together with removal 4729, track membership changes. A short add-then-remove can be a move to hide temporary privilege use.

Key fields

FieldMeaning
Group\Group NameThe group a member was added to (check if privileged)
Member\Account NameThe added member, recorded as a distinguished name (DN)
Subject\Account NameThe subject that performed the addition

References

47274729