We get a lot of event id 4735 like following:
Subject:
Security ID: SYSTEM
Account Name: xxx$
Account Domain: xxx
Logon ID: 0x3E7
Group:
Security ID: BUILTIN\Administrators
Group Name: Administrators
Group Domain: Builtin
Changed Attributes:
SAM Account Name: -
SID History: -
Additional Information:
Privileges: -
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{xxx}" />
<EventID>4735</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13826</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2023-10-13T16:56:50.930730000Z" />
<EventRecordID>113144987</EventRecordID>
<Correlation ActivityID="{xxx}" />
<Execution ProcessID="840" ThreadID="10404" />
<Channel>Security</Channel>
<Computer>xxx</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserName">Administrators</Data>
<Data Name="TargetDomainName">Builtin</Data>
<Data Name="TargetSid">S-xxx</Data>
<Data Name="SubjectUserSid">S-xxx</Data>
<Data Name="SubjectUserName">xxx$</Data>
<Data Name="SubjectDomainName">xxx</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="PrivilegeList">-</Data>
<Data Name="SamAccountName">-</Data>
<Data Name="SidHistory">-</Data>
</EventData>
</Event>
According to doc, "This event is logged on domain controllers for Active Directory domain local groups to change the Security Local group identified in Group." However, it does not seems contain information about what was changed. "PrivilegeList", "SamAccountName", "SidHistory" are all "-"
We are seeing this in both DC and member servers.
Anyone has clue?
