4752 A member was removed from a security-disabled global group
Written when a member is removed from a security-disabled (distribution) global group. Paired with addition 4751, it tracks distribution-group membership changes.
Overview
The subcategory is Audit Distribution Group Management. It is generated when a member is removed from a distribution global group.
How it is triggered
- Removing a member from a distribution group.
Security review points
- Distribution groups carry no access rights, so the security impact of a removal is limited. Review it as needed from the angle of changing notification/distribution recipients.
Notes for log review
- It is often handled as configuration change management. Do not confuse it with security-group removals (4729/4733).
Key fields
| Field | Meaning |
|---|---|
Group\Group Name | The distribution group |
Member\Account Name | The removed member |
Subject\Account Name | The subject that performed the removal |