Auditing of Domain Local Groups

P

picilo59

So I have been searching online for some time now trying to find an event for changes made to Domain Local Groups. I have found the following event codes have to do with Security-Enabled Local Groups, 4731, 4735, 4734, 4732, and 4733. However these all have to do with "Builtin Local Groups" not "Domain Local Groups".

For example I can see in the event log event 4732 where a user was added to "BUILTIN\Administrators", and when that user is removed from the same group I see event 4733. But I can't see any event on when a Domain Local Group has been changed.

Note that "Domain Local Groups" are not the same as "Builtin Local Groups".

Does anyone know of a good way to track down changes to "Domain Local Groups"?

Continue reading...
 
Back
Top Bottom