A member was added to a security-enabled local group

// EVENT DEFINITION:

A member was added to a security-enabled local group (e.g., local Administrators, Remote Desktop Users).

// DETAILED TELEMETRY & CONTEXT:

Event ID 4732 is recorded when an account is added to a local security group on a Windows server or workstation, most notably the local `Administrators` group (`S-1-5-32-544`) or `Remote Desktop Users`. Attackers frequently add local or domain accounts to the local Administrators group on compromised endpoints to secure local persistence and administrative control.

[ ! ]Failure Reason / Root Cause Analysis

Endpoint administrative support actions, domain group policy deployment, or malicious local privilege elevation.

Operational Metadata & Applicability

Log Category:Account Management

Audit Type Classification:Success Audit

Supported Operating Systems:Windows Server 2016, 2019, 2022 / Windows Client 10, 11 (Enterprise / Pro)

Threat Hunting Keywords:

local administratorslocal groupmember addedS-1-5-32-544remote desktop usersprivilege escalation

MITRE ATT&CK Framework Alignment

T1069.001

Local GroupsTactic: Privilege Escalation

T1098

Account ManipulationTactic: Persistence

Mitigation Playbook & Recommended SOC Actions

•Alert immediately whenever an unexpected account is added to the local `Administrators` (`TargetSid: S-1-5-32-544`) group.
•Investigate the `SubjectUserName` responsible for adding members to privileged local groups on critical servers.
•Enforce Local Administrator Password Solution (Windows LAPS) and restrict manual group modifications via Group Policy.

Representative Windows Event XML Schema

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4732</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12544</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2026-07-17T09:54:44.311Z" />
    <EventRecordID>1048576</EventRecordID>
    <Correlation />
    <Execution ProcessID="612" ThreadID="1024" />
    <Channel>Security</Channel>
    <Computer>DC01.enterprise.internal</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">SYSTEM</Data>
    <Data Name="SubjectDomainName">NT AUTHORITY</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <!-- Event telemetry fields specific to A member was added to a security-enabled local group -->
  </EventData>
</Event>

Correlated / Related Security Event IDs

Need to export or view this event without styling/layout wrappers?

Open Simple Plain Detail Page →

ADVERTISEMENT / SPONSORED RESERVATION (728x90)