Windows Event ID 4727: A security-enabled global group was created
Written when a security-enabled global group (a domain group) is created. It is generated only on domain controllers and captures the creation of an AD group, the unit by which privileges are granted.
Overview
The subcategory is Audit Security Group Management. It is generated when a security-enabled global group is created in Active Directory, recorded only on domain controllers. It is the domain-group counterpart to the local-group 4731. A global group has the scope of “may only have members from its own domain, but can be granted access in trusting domains as well.”
How it is triggered
- Global group creation via
New-ADGroup -GroupScope Global -GroupCategory Security, Active Directory Users and Computers (ADUC),net group <name> /add /domain, and so on.
Security review points
- An attacker may create their own group to consolidate accounts and privileges in it, for later privilege management, masquerading, or persistence. Confirm the creating subject and group name are as expected.
- Creating a group alone grants no privileges. Combine it with the following member addition 4728 and rights grants/delegation to that group to track a privilege-expansion sequence.
- The universal-group counterpart is 4754; the local-group one is 4731. Do not confuse the scopes.
Notes for log review
- It also occurs during legitimate operations (creating new departments or roles). Match against normal patterns of creating subject and naming conventions.
- Read it as a group lifecycle together with deletion 4730 and member addition 4728.
Key fields
| Field | Meaning |
|---|---|
New Group\Group Name | The created group name |
New Group\Group Domain | The domain the group belongs to |
Subject\Account Name | The subject that created the group |