4751 A member was added to a security-disabled global group
Written when a member is added to a security-disabled (distribution) global group. It is a member change that carries no access rights, so the priority is lower.
Overview
The subcategory is Audit Distribution Group Management. It is generated when a new member is added to a distribution global group.
How it is triggered
- Adding a member to a distribution group (such as enrolling in a mailing list).
Security review points
- Distribution group membership grants no privileges, so its own privilege-escalation risk is small. However, note that if the group is later converted to a security group (4764), privileges reach these members.
- Since it involves notification recipients and distribution scope, there is some room to review it from the angle of where confidential information is distributed.
Notes for log review
- Do not confuse it with security-group member additions (4728/4732). A distribution-group 4751 is normally not a primary target of privilege monitoring.
Key fields
| Field | Meaning |
|---|---|
Group\Group Name | The distribution group |
Member\Account Name | The added member |
Subject\Account Name | The subject that performed the addition |