Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.
Auditing security-group membership changes creates evidence for privileged access reviews and incident response.
Prerequisites
- Administrative access to the affected Windows Server hosts.
- A tested backup or documented rollback point.
- An approved maintenance window for production systems.
Step-by-step configuration
- Enable Audit Security Group Management through a domain controller policy.
- Configure success and failure auditing according to policy.
- Force policy refresh on a test domain controller.
- Add and remove a test account from a test security group.
- Forward relevant events to the central log platform.
PowerShell and command-line procedure
auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
auditpol /get /subcategory:"Security Group Management"
Get-WinEvent -FilterHashtable @{LogName="Security";Id=4728,4729,4732,4733,4756,4757} -MaxEvents 20
Verification
Security events identify the actor, target account, group, domain controller, and timestamp.
Rollback
Restore the previous advanced audit policy through the governing GPO; do not erase collected security events.
Security and operational guidance
- Apply least privilege and document every production change.
- Test the procedure in an isolated environment before broad deployment.
- Replace all example names, paths, and TEST-NET addresses with approved production values.
- Monitor relevant Windows event logs after the change.
Related resources
Deploy or manage Canadian Windows VPS infrastructure with networkmanager.info. Validate production decisions against the official Microsoft Windows Server documentation.
