---
title: Audit Security Group Management 
description: The policy setting, Audit Security Group Management, determines if audit events are generated when specific security group management tasks are performed.
ms.assetid: ac2ee101-557b-4c84-b9fa-4fb23331f1aa
ms.reviewer: 
manager: aaroncz
ms.author: vinpa
ms.pagetype: security
ms.prod: windows-client
ms.mktglfcycl: deploy
ms.sitesec: library
ms.localizationpriority: none
author: vinaypamnani-msft
ms.date: 09/06/2021
ms.technology: itpro-security
ms.topic: reference
---

# Audit Security Group Management


Audit Security Group Management determines whether the operating system generates audit events when specific security group management tasks are performed.

**Event volume**: Low.

This subcategory allows you to audit events generated by changes to security groups such as the following:

- Security group is created, changed, or deleted.

- Member is added or removed from a security group.

- Group type is changed.

| Computer Type     | General Success | General Failure | Stronger Success | Stronger Failure | Comments |
|-------------------|-----------------|-----------------|------------------|------------------|----------|
| Domain Controller | Yes             | No              | Yes              | No               | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated. <br> This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
| Member Server     | Yes             | No              | Yes              | No               | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated. <br> This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
| Workstation       | Yes             | No              | Yes              | No               | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated. <br> This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |

**Events List:**

- [4731](event-4731.md)(S): A security-enabled local group was created.

- [4732](event-4732.md)(S): A member was added to a security-enabled local group.

- [4733](event-4733.md)(S): A member was removed from a security-enabled local group.

- [4734](event-4734.md)(S): A security-enabled local group was deleted.

- [4735](event-4735.md)(S): A security-enabled local group was changed.

- [4764](event-4764.md)(S): A group’s type was changed.

- [4799](event-4799.md)(S): A security-enabled local group membership was enumerated.

- 4727(S): A security-enabled global group was created. See event _[4731](event-4731.md): A security-enabled local group was created._ Event 4727 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference.

  > [!IMPORTANT]
  > Event 4727(S) generates only for domain groups, so the Local sections in event [4731](event-4731.md) do not apply.

- 4737(S): A security-enabled global group was changed. See event _[4735](event-4735.md): A security-enabled local group was changed._ Event 4737 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference.

  > [!IMPORTANT]
  > Event 4737(S) generates only for domain groups, so the Local sections in event [4735](event-4735.md) do not apply.

- 4728(S): A member was added to a security-enabled global group. See event _[4732](event-4732.md): A member was added to a security-enabled local group._ Event 4728 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference.

  > [!IMPORTANT]
  > Event 4728(S) generates only for domain groups, so the Local sections in event [4732](event-4732.md) do not apply.

- 4729(S): A member was removed from a security-enabled global group. See event _[4733](event-4733.md): A member was removed from a security-enabled local group._ Event 4729 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference.

  > [!IMPORTANT]
  > Event 4729(S) generates only for domain groups, so the Local sections in event [4733](event-4733.md) do not apply.

- 4730(S): A security-enabled global group was deleted. See event _[4734](event-4734.md): A security-enabled local group was deleted._ Event 4730 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference.

  > [!IMPORTANT]
  > Event 4730(S) generates only for domain groups, so the Local sections in event [4734](event-4734.md) do not apply.

- 4754(S): A security-enabled universal group was created. See event _[4731](event-4731.md): A security-enabled local group was created._ Event 4754 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference.

  > [!IMPORTANT]
  > Event 4754(S) generates only for domain groups, so the Local sections in event [4731](event-4731.md) do not apply.

- 4755(S): A security-enabled universal group was changed. See event _[4735](event-4735.md): A security-enabled local group was changed._ Event 4755 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference.

  > [!IMPORTANT]
  > Event 4755(S) generates only for domain groups, so the Local sections in event [4735](event-4735.md) do not apply.

- 4756(S): A member was added to a security-enabled universal group. See event _[4732](event-4732.md): A member was added to a security-enabled local group._ Event 4756 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference.

  > [!IMPORTANT]
  > Event 4756(S) generates only for domain groups, so the Local sections in event [4732](event-4732.md) do not apply.

- 4757(S): A member was removed from a security-enabled universal group. See event _[4733](event-4733.md): A member was removed from a security-enabled local group._ Event 4757 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference.

  > [!IMPORTANT]
  > Event 4757(S) generates only for domain groups, so the Local sections in event [4733](event-4733.md) do not apply.

- 4758(S): A security-enabled universal group was deleted. See event _[4734](event-4734.md): A security-enabled local group was deleted._ Event 4758 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference.

  >[!IMPORTANT]
  > Event 4758(S) generates only for domain groups, so the Local sections in event [4734](event-4734.md) do not apply.