Event ID 4732: a member was added to a security-enabled local group

Event 4732 means someone was added to a local group – and the groups that matter are Administrators and Remote Desktop Users. Adding an account to Administrators is how a foothold becomes full control, so this is one of the few events worth an alert every single time.

1. The fields

• Member › Security ID / Account Name (MemberSid, MemberName): who was added. For local accounts the name is often -; the SID is always there.
• Group › Group Name / Security ID (TargetUserName, TargetSid): which group.
• Subject (SubjectUserName): who made the change.

Audit subcategory Security Group Management, on by default.

2. PowerShell: who was added to Administrators or Remote Desktop Users

function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
$watch = @{ 'S-1-5-32-544' = 'Administrators'; 'S-1-5-32-555' = 'Remote Desktop Users' }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732,4733; StartTime=(Get-Date).AddDays(-90)} -ErrorAction SilentlyContinue |
  ForEach-Object { $f = Get-EventFields $_
    if ($watch.ContainsKey($f.TargetSid)) {
      $who = try { (New-Object Security.Principal.SecurityIdentifier $f.MemberSid).Translate([Security.Principal.NTAccount]).Value } catch { $f.MemberSid }
      [pscustomobject]@{ Time = $_.TimeCreated; Change = if ($_.Id -eq 4732) { 'added' } else { 'removed' }; Member = $who; Group = $watch[$f.TargetSid]; By = $f.SubjectUserName } } } |
  Sort-Object Time | Format-Table -AutoSize

Who is in the groups now:

Get-LocalGroupMember -SID S-1-5-32-544
Get-LocalGroupMember -SID S-1-5-32-555

3. Normal or attack?

• Normal: a planned change by your IT; a Group Policy (Restricted Groups) setting the members; software installers adding a service account to a specific group.
• Suspicious: an unknown or new account (4720) added to Administrators; done by an ordinary user account or by SYSTEM outside an installation; at night; immediately followed by a Remote Desktop logon of that account.

If you did not expect it: remove the member, disable the account, and check its logons and what it did.

4. Let Coinetic watch it for you

Coinetic keeps the network side of a Server or PC in shape, so attackers rarely get as far as this:

• A security check with plain explanations: open ports, risky settings and firewall rules nobody needs any more – each with a severity and a fix you can undo.
• Firewall change watch: if something switches the firewall off or opens a port to everyone, Coinetic alerts you and names the program.
• Logging kept on: Coinetic keeps the audit settings and the Security log size it needs, and reports audit settings that flood the log.
• Ask AI (Pro + AI): “Which finding of the security check should I fix first, and why?”

More guides: all Coinetic guides.

Frequently asked

Why is the member name a dash?

For local accounts Windows often records only the SID. Translate it (see the PowerShell above) or look it up with Get-LocalUser -SID.

What is the difference between 4732, 4728 and 4756?

4732 is a local or domain local group (Administrators on a computer), 4728 a global group (Domain Admins), 4756 a universal group (Enterprise Admins). All three matter for admin groups.

Our Group Policy keeps re-adding members - is that 4732?

Yes. Restricted Groups or Group Policy Preferences re-apply the membership and log 4732 / 4733 when something changes.