SOC Event Lookup
Event ID 4732GroupMgmtP1

Windows Event ID 4732: A member was added to a security-enabled local group

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4732 records a member being added to a security-enabled local group, including the local Administrators group.

Technical Metadata

Technical metadata for Event ID 4732
Event ID4732
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0004 Privilege Escalation / T1098.007 Account Manipulation: Additional Local or Domain Groups
Key fields to watchMember, Group, Subject

Trigger Scenarios

Windows generates the event when local group membership changes on the audited system.

Key Fields

Member

The account or SID added to the group. Resolve SIDs when a name is unavailable.

Group

The local group receiving the member. Administrators and Remote Desktop Users are especially important.

Subject

The identity that made the change. Validate its administrative role and session context.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Event ID 4732
SecurityEvent
| where EventID == 4732
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Event ID 4732
index=wineventlog source="WinEventLog:Security" EventCode=4732
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
Cortex XQL: Retrieve Event ID 4732
dataset = microsoft_windows_raw
| filter edr_event_id = 4732
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
Query reference
Sigma rule: Windows Event ID 4732
title: Windows Event ID 4732
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4732
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

  • T1098.007Account Manipulation: Additional Local or Domain Groups

Detection Notes

T1098.007 Additional Local or Domain Groups is indicated when Group is Administrators or Remote Desktop Users and MemberSid resolves to a new, dormant, or foreign-domain account. An addition to Administrators followed by 4672 and a Type 10 4624 in a correlation window=60 minutes is a concrete local-admin access chain; retain MemberSid when MemberName is '-' because name resolution can fail.

Common False Positives

  • Endpoint management and approved provisioning workflows can add local administrators.
  • Break-glass and support processes may temporarily add accounts during incidents.

Related Events

Sample Log

Sanitized event sample
Member: CORP\jsmith
Group: Administrators
Subject: CORP\admin.ops
Computer: WS-014

Frequently Asked Questions

What does Windows Event ID 4732 mean?

Event ID 4732 records that a member was added to a security-enabled local group and identifies the actor, member SID, and group.

Which local groups make Event ID 4732 high priority?

Additions to Administrators, Remote Desktop Users, Backup Operators, and other locally privileged groups deserve focused review, with group names resolved in the monitored system's language and policy context.

Can Event ID 4732 show a member name as unresolved?

Yes. Microsoft notes that MemberName can be a hyphen when the SID cannot be resolved; retain MemberSid and resolve it against directory and local-account data.

Sources