4753 A security-disabled global group was deleted
Written when a security-disabled (distribution) global group is deleted. Paired with creation 4749, it tracks the distribution group’s lifecycle.
Overview
The subcategory is Audit Distribution Group Management. It is generated when a distribution global group is deleted.
How it is triggered
- Deletion of a distribution global group.
Security review points
- Distribution groups carry no access rights, so the security impact of deletion is small. Handle it as change management of distribution recipient configuration.
Notes for log review
- Record it as configuration change management. Distinguish it from security-group deletions (4730/4734).
Key fields
| Field | Meaning |
|---|---|
Group\Group Name | The deleted distribution group |
Subject\Account Name | The subject that performed the deletion |