Hi what would be the best way to check if after a user has been added to a group, they have not been removed from the same group within say 24 hours.  I currently have a search that provides a table that shows group additions and group removals using winevent index. What is the best way to find events where there has been an addition but no removal for the same group and user added within 24 hours. I started to look at | transaction but I don't feel this is correct as I am interested if there has not been a removal after a time period. Failing this if anyone has an alternate solution to alert when a user has been added and not removed from a group within a time period that would be much appreciated. Thanks ... View more