topic Re: User added and user removed in Getting Data In

User added and user removed

bshuford — Fri, 04 Feb 2011 23:02:45 GMT

Hello, I have an event ID 641 which is global security group modified.

This information tells me what administrator changed the security group but it doesn't tell me who was added or removed from this security group. I don't seem to even see a log of it.

Can someone tell me if there is a way to turn on more auditing so that I can log this infomration?

Re: User added and user removed

Ron_Naken — Sat, 05 Feb 2011 01:50:15 GMT

Event 641 (Local Group), 639 (Global Group), and 659 (Universal Group) are change notifications. You would want to track the following:

Local Group:   636 (user added)    637 (user removed)
Global Group:  632 (user added)    633 (user removed)
Universal Group:  660 (user added)  661 (user removed)

HTH
ron

Re: User added and user removed

Oranges — Sat, 05 Feb 2011 01:56:10 GMT

Be sure to enable Audit Account Management in your GPO for each DC in a domain or on each server for a workgroup.