User added and user removed

[bshuford]

Hello, I have an event ID 641 which is global security group modified.

This information tells me what administrator changed the security group but it doesn't tell me who was added or removed from this security group. I don't seem to even see a log of it.

Can someone tell me if there is a way to turn on more auditing so that I can log this infomration?

[Oranges]

Be sure to enable Audit Account Management in your GPO for each DC in a domain or on each server for a workgroup.

[Ron_Naken · Accepted solution]

Event 641 (Local Group), 639 (Global Group), and 659 (Universal Group) are change notifications. You would want to track the following:

Local Group:   636 (user added)    637 (user removed)
Global Group:  632 (user added)    633 (user removed)
Universal Group:  660 (user added)  661 (user removed)

HTH
ron