SOC Event Lookup
Event ID 4733AccountManagementP3

Windows Event ID 4733: A member was removed from a security-enabled local group

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4733 records removal of a member from a security-enabled local group.

Technical Metadata

Technical metadata for Event ID 4733
Event ID4733
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0040 Impact / T1531 Account Access Removal
Key fields to watchMember Security ID / Account Name, Group Name / Group Domain, Subject Logon ID / Privileges

Trigger Scenarios

Microsoft documents that this event is generated for each removed member on domain controllers, member servers, and workstations.

Key Fields

Member Security ID / Account Name

The principal removed from the local security group; Account Name may be - for some local-group cases.

Group Name / Group Domain

The local group affected; compare Group Domain to Computer to distinguish local SAM and domain local groups.

Subject Logon ID / Privileges

Actor session and any privilege list associated with the removal.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4733
SecurityEvent
| where EventID == 4733
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the documented fields.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4733
index=wineventlog source="WinEventLog:Security" EventCode=4733
| table _time, host, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
Cortex XQL: Retrieve Windows Security Event ID 4733
dataset = microsoft_windows_raw
| filter edr_event_id = 4733
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested. Inspect raw fields because parsed names vary.
Query reference
Sigma rule: Windows Security Event ID 4733
title: Windows Security Event ID 4733
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4733
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This retrieves the event and is not a standalone malicious-behavior detection.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
MemberSidSIDThe principal removed from the local security group.Interpret MemberSid with the full event and correlated activity; this value alone is not proof of compromise. Source
GroupNameAdministratorsA privileged local group whose removals can revoke administrative access.Interpret GroupName with the full event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1531Account Access Removal

Detection Notes

Alert on threshold=1 removal from Administrators, Remote Desktop Users, Backup Operators, or other privileged local groups outside an approved endpoint-management cycle. Microsoft documents 4733 per removed member and notes 4735 often precedes it without details; a suspicious actor can remove competing administrators or cleanup evidence of earlier T1531 Account Access Removal. Correlate Subject Logon ID with 4624/4688 and compare Group Domain to Computer for local SAM scope.

Common False Positives

  • Group Policy Preferences and endpoint management can enforce local Administrators membership and remove unmanaged principals.
  • Deprovisioning and access review processes remove users from privileged local groups.

Related Events

Sample Log

Sanitized event sample
EventID: 4733
Subject Account Name: admin.ops
Subject Logon ID: 0x27a79
Member Security ID: S-1-5-21-111-222-333-1109
Member Account Name: CN=helpdesk,CN=Users,DC=corp,DC=local
Group Name: Administrators
Group Domain: HOST01

Frequently Asked Questions

What does Windows Event ID 4733 mean?

A member was removed from a security-enabled local group.

Does Event ID 4733 always indicate malicious activity?

No. Endpoint management and access reviews routinely remove members.

How should Event ID 4733 be investigated?

Check whether the group is privileged, identify the subject and member, and correlate the subject logon to process creation.

Sources