SOC Event Lookup
Event ID 4729AccountManagementP3

Windows Event ID 4729: A member was removed from a security-enabled global group

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4729 records removal of a member from a security-enabled global group.

Technical Metadata

Technical metadata for Event ID 4729
Event ID4729
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0040 Impact / T1531 Account Access Removal
Key fields to watchMember Security ID / Account Name, Group Name / Group Domain / Group Security ID, Subject Account Name / Logon ID

Trigger Scenarios

Microsoft documents 4729 as the global-group counterpart to 4733, with the same fields and recommendations except group type.

Key Fields

Member Security ID / Account Name

The user, group, or computer removed from the global security group.

Group Name / Group Domain / Group Security ID

The affected global group. Privileged groups such as Domain Admins require immediate validation.

Subject Account Name / Logon ID

The actor and hexadecimal logon session that performed the removal.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4729
SecurityEvent
| where EventID == 4729
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the documented fields.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4729
index=wineventlog source="WinEventLog:Security" EventCode=4729
| table _time, host, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
Cortex XQL: Retrieve Windows Security Event ID 4729
dataset = microsoft_windows_raw
| filter edr_event_id = 4729
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested. Inspect raw fields because parsed names vary.
Query reference
Sigma rule: Windows Security Event ID 4729
title: Windows Security Event ID 4729
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4729
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This retrieves the event and is not a standalone malicious-behavior detection.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
MemberSidSIDThe security principal removed from the global group.Interpret MemberSid with the full event and correlated activity; this value alone is not proof of compromise. Source
GroupNameDomain AdminsA high-impact privileged group example requiring immediate validation.Interpret GroupName with the full event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1531Account Access Removal

Detection Notes

Use threshold=1 for removals from privileged global groups such as Domain Admins, Enterprise Admins, or custom Tier 0 groups. Microsoft documents 4729 as the removal counterpart to 4728/4733; if Member Security ID is removed shortly after suspicious access, the actor may be hiding or changing persistence, which maps to T1531 Account Access Removal. Correlate Subject Logon ID with 4624/4688 and verify the identity-governance ticket.

Common False Positives

  • Privileged access reviews and role cleanup legitimately remove members from groups.
  • Automated identity governance can remove expired group memberships.

Related Events

Sample Log

Sanitized event sample
EventID: 4729
Subject Account Name: admin.ops
Subject Logon ID: 0x27a79
Member Security ID: S-1-5-21-111-222-333-1109
Member Account Name: CN=svc-old,CN=Users,DC=corp,DC=local
Group Name: Domain Admins
Group Domain: CORP

Frequently Asked Questions

What does Windows Event ID 4729 mean?

A member was removed from a security-enabled global group.

Does Event ID 4729 always indicate malicious activity?

No. Authorized access revocation and role changes generate it.

How should Event ID 4729 be investigated?

Validate the subject, member, group and change ticket and correlate the subject logon with process activity.

Sources