Windows Event ID 4780: ACL was set on accounts in administrators groups
- Applicable version
- Windows Server 2008 R2 and later
- Last reviewed
- 2026-07-21
Quick summary
Windows Security Event ID 4780 records AdminSDHolder ACL reset activity for protected administrative accounts.
Technical Metadata
| Event ID | 4780 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0004 Privilege Escalation / T1098.007 Account Manipulation: Additional Local or Domain Groups |
| Key fields to watch | Target Account: Security ID / Account Name / Account Domain, Subject: Security ID / Account Name / Logon ID, Privileges |
Trigger Scenarios
On the PDC emulator, Windows compares protected security principals with AdminCount=1 against the AdminSDHolder ACL about every hour and resets differing ACLs, generating this event.
Key Fields
Target Account: Security ID / Account Name / Account Domain
Identifies the protected user, group, or machine account whose ACL was reset to match AdminSDHolder.
Subject: Security ID / Account Name / Logon ID
Identifies the security context associated with the reset operation and supports correlation to administrative activity.
Privileges
Additional Information field in the Microsoft schema. Use it to understand whether special privileges were present during the ACL reset.
Threat Hunting Queries
SecurityEvent
| where EventID == 4780
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4780
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4780- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4780
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4780
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
MITRE ATT&CK Mapping
- T1098.007Account Manipulation: Additional Local or Domain Groups
Detection Notes
T1098.007 Additional Local or Domain Groups is supported when TargetUserName first appears in 4780 immediately after an unexpected 4728, 4732, or 4756 privileged-group addition. AdminSDHolder normally reapplies protected ACLs on a periodic schedule, so use a local threshold=1 only for newly protected or unauthorized targets and correlate SubjectLogonId; do not treat the ACL reset itself as malicious.
Common False Positives
- Expected hourly AdminSDHolder protection can generate this event after legitimate ACL drift on protected accounts.
- Directory cleanup or privileged group membership changes can cause new accounts with AdminCount=1 to be protected.
Related Events
Sample Log
EventID: 4780
Target Account Name: svc-build
Target Account Domain: CORP
Subject Account Name: DC01$
Logon ID: 0x3e7
Privileges: -Frequently Asked Questions
What does Windows Event ID 4780 mean?
Event ID 4780 records that Active Directory set the ACL on an account belonging to a protected administrators group.
Is Event ID 4780 itself malicious?
No. AdminSDHolder protection periodically resets ACLs on protected accounts; the event becomes useful when a new or unexpected account entered protected-group scope.
Which events should be correlated with 4780?
Review preceding 4728, 4732, or 4756 group additions for the target account and validate the actor that changed privileged membership.
Sources
- 4780: Microsoft Windows security auditing event reference
Microsoft · vendor
- Account Manipulation: Additional Local or Domain Groups (T1098.007)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule