Event ID 4728: member added to global security group
What Event ID 4728 (member added to global security group) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4728 records a member being added to a global security group in Active Directory. Most of these are routine. The ones that matter are additions to privileged groups such as Domain Admins.
The fields that matter
| Field | What it tells you |
|---|---|
| Subject | Who made the change. |
| Member | The account added, shown as a SID and a name. |
| Group Name | The group it was added to. |
What is normal
Access requests handled by IT, and automated group management tools.
When Event ID 4728 is suspicious
- Additions to Domain Admins or other privileged groups without a change ticket.
- An addition followed by removal (4729) shortly after: someone used the rights and tried to tidy up.
- Additions made by accounts that are not admins of that group.
Common false positive: Group management tools and HR-driven access changes add members in bulk. Keep a list of groups that should alert, rather than alerting on all of them.
Find Event ID 4728 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4728
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 4732: Member added to local security group
- Event ID 4756: Member added to universal security group
- Event ID 4729
- Event ID 4720: User account created
FAQ
What is the difference between 4728, 4732 and 4756?
4728 is a global group, 4732 a domain-local or local group (including Administrators), and 4756 a universal group. Enterprise Admins and Schema Admins are universal, so watch 4756 for those.
Which groups should always alert?
Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Backup Operators, Server Operators and DnsAdmins.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.