Windows Event ID 4756: A member was added to a security-enabled universal group

Written when a member is added to a security-enabled universal group. Addition to the forest’s top-level Enterprise Admins / Schema Admins leads directly to control of the entire forest, making it a top-tier account-management event.

Overview

The subcategory is Audit Security Group Management. It is generated when a new member is added to a universal group, recorded only on domain controllers. One event appears per added member. As with the global-group 4728, the Member\Account Name is recorded as a distinguished name (DN) (for example, CN=Auditor,CN=Users,DC=contoso,DC=local). The local-group counterpart is 4732.

How it is triggered

• Member addition to a universal group via Add-ADGroupMember, Active Directory Users and Computers (ADUC), and so on.

Security review points

• Addition to a forest-wide privileged group is most important. Enterprise Admins, which controls the forest, and Schema Admins, which can modify the schema, are both universal groups, so additions to them are recorded as 4756. These additions lead directly to compromise of the entire forest, so monitor them at top priority.
• A sequence of account creation 4720 then addition to a high-privilege universal group 4756 suggests forest-scale backdoor creation.
• Addition to a global group is 4728; addition to a local group is 4732. Do not confuse the scopes.

Notes for log review

• Because the member is recorded as a DN, it looks hard to read at first. Resolve the CN= portion to make clear which account was added.
• Treat additions to Enterprise Admins / Schema Admins as a high-priority event that almost never occurs in normal operation; alert on even a single occurrence.
• Changes replicate across the forest via the Global Catalog. Keep the scope of impact in mind and correlate with 4754 and related account creation.

Key fields

References

• Microsoft Learn: Audit Security Group Management
• Ultimate Windows Security: Event ID 4756