← Event ID reference

4728

A member was added to a security-enabled global group

Log: Security
Source: Microsoft-Windows-Security-Auditing
Account changes
Warning

What it means

Someone was added to a domain group. Related events: 4732 (local group) and 4756 (universal group).

Why it matters

Additions to Domain Admins, Enterprise Admins or other privileged groups should always be reviewed.

What to do

Alert on any change to privileged groups.
Check who made the change and whether a ticket exists.

Find it with PowerShell

Get-WinEvent -MaxEvents 20 -FilterHashtable @{
  LogName = 'Security'; Id = 4728
} | Select-Object TimeCreated, ProviderName, Message

Add -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.

Source

Microsoft Learn: 4728 event reference

Seeing a lot of these? We can investigate, or alert you automatically through our monitoring.