Event ID 4732: member added to local security group

Event ID 4732 records a member added to a security-enabled local group. On a domain controller that includes the built-in Administrators group; on member servers and workstations it is the local Administrators group, which is a common way to get persistent admin rights.

The fields that matter

What is normal

IT adding support groups to local Administrators through Group Policy or LAPS-style tooling, and provisioning during setup.

When Event ID 4732 is suspicious

• A user account added to local Administrators on a workstation or server by hand.
• Additions to Remote Desktop Users on servers that should not allow RDP.
• Additions made by a non-admin account, or outside working hours.

Find Event ID 4732 with PowerShell

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
  ForEach-Object {
    $d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
    ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
    [pscustomobject]$d
  } | Format-List

Microsoft Sentinel (KQL)

SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4732
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated desc

Related events

• Event ID 4728: Member added to global security group
• Event ID 4756: Member added to universal security group
• Event ID 4733
• Event ID 4672: Special privileges assigned to new logon

FAQ

Is 4732 logged on the domain controller or the member server?

On the machine whose local group changed. For domain-local groups it is logged on the DC.

Which event shows a member being removed?

4733 for local groups, 4729 for global groups and 4757 for universal groups.