SOC Event Lookup
Event ID 4735AccountManagementP3

Windows Event ID 4735: A security-enabled local group was changed

Windows Security Event ID 4735 records a change to a security-enabled local group.

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-13

Trigger Scenarios

Microsoft documents that this event is generated when a security-enabled local group is changed on domain controllers, member servers, and workstations, though some property changes do not invoke it.

Key Fields

Group Name / Group Domain / Group Security ID

The changed local group; privileged groups need additional scrutiny.

Changed Attributes

Fields such as SamAccountName and SidHistory may show what changed, but Microsoft notes some changes produce limited detail.

Subject Logon ID

Hexadecimal actor session to correlate with 4624 and process creation.

Common False Positives

  • Group Policy and endpoint management commonly refresh local group attributes.
  • Administrative maintenance can rename or update group metadata without changing membership.

Related Events

MITRE ATT&CK Mapping

  • T1098Account Manipulation

Detection Notes

Use threshold=1 for 4735 on Administrators, Remote Desktop Users, or backup/operator groups when Changed Attributes include SidHistory or SamAccountName changes, or when 4732/4733 occurs nearby. Microsoft documents 4735 as local security group change telemetry and notes it can precede membership events; changing privileged group properties can support T1098 Account Manipulation even when membership is not shown in this event. Correlate Subject Logon ID with 4624/4688 and directory or local SAM management activity.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 4735
| project TimeGenerated, Computer, Account, GroupName, GroupDomain, SidHistory, SamAccountName
Splunk SPL
index=wineventlog EventCode=4735 | table _time, host, Account_Name, Group_Name, Group_Domain, SidHistory, SamAccountName
Sample Log
EventID: 4735
Subject Account Name: admin.ops
Subject Logon ID: 0x27a79
Group Name: Administrators
Group Domain: HOST01
Changed Attributes: SamAccountName=Administrators; SidHistory=-

Source

Official documentationMachine-readable JSON