4750 A security-disabled global group was changed
Written when the attributes of a security-disabled (distribution) global group are changed. It is a setting change on a group with no access rights, so the priority is lower.
Overview
The subcategory is Audit Distribution Group Management. It is generated when a distribution global group’s properties (name, description, and so on) are changed. Member changes are recorded separately by 4751/4752.
How it is triggered
- A change to a distribution group’s attributes.
Security review points
- Since a distribution group has no access rights, the security impact of a change is limited. If a type change converts it to a security group, that is recorded separately by 4764, so prioritize that.
Notes for log review
- It is normally handled as configuration change management. Recording the changed group, attribute, and subject is often sufficient.
Key fields
| Field | Meaning |
|---|---|
Group\Group Name | The changed distribution group |
Subject\Account Name | The subject that made the change |