SOC Event Lookup
Event ID 4728GroupMgmtP2

Windows Event ID 4728: A member was added to a security-enabled global group

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4728 records that a user or computer account was added to a security-enabled global group in Active Directory, logging the Subject performing the change, the Member added, and the target Group.

Technical Metadata

Technical metadata for Event ID 4728
Event ID4728
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0004 Privilege Escalation / T1098.007 Account Manipulation: Additional Local or Domain Groups
Key fields to watchGroup\Group Name / Group Domain, Member\Security ID / Account Name, Subject\Account Name / Logon ID

Trigger Scenarios

Any domain-level group membership addition for a security-enabled global group generates this event on a domain controller. It covers high-value targets such as Domain Admins, Enterprise Admins, Schema Admins, and other privileged role groups.

Key Fields

Group\Group Name / Group Domain

The group receiving the new member. Additions to Domain Admins, Enterprise Admins, or Schema Admins in the expected domain are the highest-priority signals. Any group whose name ends in Admins or contains a privileged role keyword also warrants review.

Member\Security ID / Account Name

The account being added. Account Name is recorded as an LDAP distinguished name (e.g., CN=jsmith,OU=Users,DC=corp,DC=example). A member account that is newly created, dormant, or sourced from an external domain in a sensitive group is a T1098 Account Manipulation indicator.

Subject\Account Name / Logon ID

The identity that made the change. Correlate the Logon ID with the 4624 logon record to find the originating workstation and session type (Type 10 remote interactive from an unexpected source is particularly suspicious).

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4728
SecurityEvent
| where EventID == 4728
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4728
index=wineventlog source="WinEventLog:Security" EventCode=4728
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4728
dataset = microsoft_windows_raw
| filter edr_event_id = 4728
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4728
title: Windows Security Event ID 4728
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4728
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

  • T1098.007Account Manipulation: Additional Local or Domain Groups

Detection Notes

T1098.007 Additional Local or Domain Groups applies when GroupName is Domain Admins, Enterprise Admins, Schema Admins, or another privileged global group and MemberSid is not approved. Use a local threshold=1 for those protected groups, then correlate SubjectLogonId with 4624 and the new member's later 4672 or Logon Type 10 activity.

Common False Positives

  • Authorized provisioning workflows and help-desk processes regularly add accounts to groups as part of onboarding or role changes.
  • Automated identity management systems may perform bulk group assignments during role migrations.

Related Events

Sample Log

Sanitized event sample
Subject:
  Security ID: CORP\attacker
  Account Name: attacker
  Account Domain: CORP
  Logon ID: 0x2F4A10
Member:
  Security ID: CORP\backdoor
  Account Name: CN=backdoor,OU=Users,DC=corp,DC=example
Group:
  Security ID: CORP\Domain Admins
  Group Name: Domain Admins
  Group Domain: CORP

Frequently Asked Questions

What does Windows Event ID 4728 mean?

Event ID 4728 records that a member was added to a security-enabled global group and is produced by the Security Group Management audit subcategory.

Which group additions are highest priority?

Additions to Domain Admins and other environment-defined privileged global groups require immediate validation against identity governance approvals.

Why should MemberSid be retained?

MemberName can be unresolved, renamed, or formatted as a distinguished name; MemberSid provides a stable identifier for directory correlation.

Sources