Windows Event ID 4729: A member was removed from a security-enabled global group

Written when a member is removed from a security-enabled global group (a domain group). Paired with addition 4728, it tracks changes to domain-group membership.

Overview

The subcategory is Audit Security Group Management. It is generated when a member is removed from a global group, recorded only on domain controllers, one event per removed member. As with addition 4728, the Member\Account Name is recorded as a distinguished name (DN). The local-group counterpart is 4733.

How it is triggered

• Member removal via net group "<group>" <user> /delete /domain, Active Directory Users and Computers (ADUC), Remove-ADGroupMember, and so on.

Security review points

• There is a move where an attacker temporarily adds themselves to a privileged group (4728), operates, then removes themselves right after to thin out the trace. A short add-then-remove pair is worth attention.
• Member removals that affect defense or operations, such as removing a legitimate administrator from Domain Admins, should be checked in the context of privilege stripping or disruption.

Notes for log review

• It also occurs on DCs during legitimate rights reviews. Match against normal patterns of the target group (whether privileged), removed member, and acting subject.
• Read it as a membership history paired with addition 4728. Resolve the CN= portion of the DN-format member name to reconcile records.

Key fields

References

• Microsoft Learn: Audit Security Group Management
• Ultimate Windows Security: Event ID 4729