Is there a search that will return all changes creation, deletion of global groups?

[DanAlexander1]

Hi to All,

I need help with creating an Active Directory changes report. 

I used Win Events like 4728, 4729, 4730 but could not print to PDF 

Is there a search that will return all changes creation, deletion of global groups?

 Thank you!

[marysan]

index=MyIndex  EventCode IN (4728,4729,4730) user=*
| eval time=_time
| convert ctime(time)
| eval msg="A user "+user+" was "+action+" on the host "+host+" by "+src_nt_domain+"\\"+src_user+" at "+time
|table msg,EventCode,action,user,signature,status

[DanAlexander1]

Thank you for helping me out. Much appreciated!

[marysan]

@DanAlexander1 
If your problem is resolved, then please click one of the "Accept as Solution" buttons to help future readers. 🙂