Windows Event ID 4730: A security-enabled global group was deleted
Written when a security-enabled global group (a domain group) is deleted. It is generated only on domain controllers and captures a change to the group-based privilege design.
Overview
The subcategory is Audit Security Group Management. It is generated when a global group is deleted, recorded only on domain controllers. Paired with creation 4727, it tracks the domain group’s lifecycle. The local-group counterpart is 4734.
How it is triggered
- Group deletion via
net group "<name>" /delete /domain, Active Directory Users and Computers (ADUC),Remove-ADGroup, and so on.
Security review points
- Deleting a group used for granting privileges signifies a change in access-control configuration. Deletion of a legitimate group leads to loss of associated privileges and access, so confirm it.
- An attacker may delete a group they created temporarily (4727) as cleanup. Cross-reference with the creation and member-addition 4728 history.
Notes for log review
- It also occurs on DCs during legitimate cleanup and inventory. Match against normal patterns of the deleted group and acting subject.
- Since deletion loses member information, reconstruct what the group was by combining with pre-deletion member add/remove logs (4728 / 4729).
Key fields
| Field | Meaning |
|---|---|
Group\Group Name | The deleted group |
Subject\Account Name | The subject that performed the deletion |