Windows Event ID 4754: A security-enabled universal group was created

Written when a security-enabled universal group is created. It is generated only on domain controllers and captures the creation of an AD group whose scope spans the entire forest.

Overview

The subcategory is Audit Security Group Management. It is generated when a security-enabled universal group is created in Active Directory, recorded only on domain controllers. A universal group has the widest scope: it can have members from any domain in the forest and can be granted access in any domain. Its membership is replicated to the Global Catalog and thus propagates across the whole forest. The global-group counterpart is 4727; the local-group one is 4731.

How it is triggered

• Universal group creation via New-ADGroup -GroupScope Universal -GroupCategory Security, Active Directory Users and Computers (ADUC), and so on.

Security review points

• Because universal groups affect the entire forest, an unexpected creating subject or group name should be treated as a broader privilege-design change.
• Creating a group alone grants no privileges, but combine it with the following member addition 4756 to track a privilege-expansion sequence. Operations involving forest-wide high-privilege groups (Enterprise Admins and Schema Admins are universal groups) are especially notable.

Notes for log review

• It also occurs during legitimate operations (role designs spanning multiple domains). Match against normal patterns of creating subject and naming conventions.
• Because it replicates across the forest via the Global Catalog, review it with the scope of impact in mind. Read it together with member addition 4756.

Key fields

References

• Microsoft Learn: Audit Security Group Management
• Ultimate Windows Security: Event ID 4754