Windows Security Log · Event 4732

Event 4732: A member was added to a local group

An account was added to a local group. When that group is Administrators, this is the moment someone gained full control of the machine — and it is one of the highest-value single events in the entire Windows log.

Also written as 4732Event ID 4732

How oftenUncommon
Vendor calls itAudit Success
LogSecurity
SourceMicrosoft-Windows-Security-Auditing

What it means for you

On a personal computer

An account was given more power on this PC. If the group was Administrators, that account can now install software, change any setting, and read any file. If you did not do this, treat it as a break-in.

For an analyst

The group name arrives as a SID in some collection paths and as a name in others — resolve it before writing rules, or you will miss the ones that matter. Alert on Administrators, Remote Desktop Users, and Backup Operators at minimum. Correlate backwards to 4720: created, promoted, used is the sequence.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample

A member was added to a security-enabled local group.

Subject:
  Security ID:    CORP\jbrooks-adm
  Account Name:   jbrooks-adm
  Account Domain: CORP
  Logon ID:       0x3E9A11

Member:
  Security ID:    CORP\svc-update
  Account Name:   CN=svc-update,CN=Users,DC=corp,DC=example

Group:
  Security ID:    BUILTIN\Administrators
  Group Name:     Administrators
  Group Domain:   Builtin

Additional Information:
  Privileges: -

The fields that decide it

Everything else in the log line is context.

TargetUserName: The group that gained a member.
MemberName: The account that was added, written as a distinguished name or a SID depending on the source.
MemberSid: The security identifier of the added account. More reliable than the name for tracking.
SubjectUserName: Who made the change.
SubjectLogonId: The session that made it. Join to the 4624 for the source address.

Ordinary reasons this happens

Most of the time it is one of these.

An administrator granting a colleague local admin rights for a legitimate reason.
Software installers adding a service account to a group they require.
Machine build and imaging processes setting up standard group memberships.
Management tooling enforcing a group policy that adds accounts to local groups.
Granting Remote Desktop access to a user who needs it.

When it is not ordinary

Privilege escalation after a foothold.

What gives it awayAn account added to Administrators by a session that arrived recently, particularly outside change windows.

ATT&CK T1098

Establishing persistence with a new privileged account.

What gives it awayA 4720 and a 4732 for the same account within minutes, followed by a sign-in.

ATT&CK T1136.001

Enabling remote access to a compromised machine.

What gives it awayAddition to Remote Desktop Users on a workstation that has no remote support requirement.

ATT&CK T1021.001

Using Backup Operators to bypass file permissions quietly.

What gives it awayAddition to Backup Operators for an account unrelated to backup software. It attracts far less attention than Administrators and grants nearly as much.

ATT&CK T1098

What to do next

Read the group name first. Administrators, Remote Desktop Users, and Backup Operators are the three that change the answer.
Resolve the member SID to an account name if your collection gives you a SID.
Check whether the added account was created recently. Creation followed by promotion is the sequence that matters.
Read SubjectUserName and confirm they perform this kind of change.
Look for a 4624 and a 4672 for the added account afterwards to see whether the new privilege was used.
Match against a change record. Unrecorded privilege grants are findings even when they turn out to be legitimate.

Queries to run

kql Privileged group additions across local, global, and universal groups in one query.

SecurityEvent | where EventID in (4732, 4728, 4756) | where TargetUserName has_any ('Administrators','Domain Admins','Enterprise Admins','Remote Desktop Users','Backup Operators') | project TimeGenerated, Computer, Group = TargetUserName, Member = MemberName, AddedBy = SubjectUserName | order by TimeGenerated desc

kql Created then promoted within the hour. Alert on this rather than on either event alone.

let created = SecurityEvent | where EventID == 4720 | project CreateTime = TimeGenerated, Computer, Account = TargetUserName;
let added = SecurityEvent | where EventID == 4732 | project AddTime = TimeGenerated, Group = TargetUserName, Account = tostring(split(MemberName, ',')[0]);
created | join kind=inner added on Account | where AddTime - CreateTime < 1h

powershell Local check on a single machine. Useful when investigating one host without central logging.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732} -MaxEvents 100 | Select-Object TimeCreated, @{n='Group';e={$_.Properties[2].Value}}, @{n='Member';e={$_.Properties[0].Value}}, @{n='By';e={$_.Properties[6].Value}}

splunk

index=wineventlog EventCode=4732 Group_Name="Administrators" | table _time dest Group_Name Member_Name Account_Name

Common questions

Someone was added to the Administrators group and I did not do it. What does that mean?

It means an account now has full control of that machine — able to install software, disable security tools, read every file, and create further accounts. Treat it as a compromise until proven otherwise: check who made the change in the Subject section, remove the membership, and look for what that account did afterwards.

What is the difference between Event 4732 and Event 4728?

4732 covers local groups, which exist on a single machine. 4728 covers domain global groups such as Domain Admins, which apply across the whole domain. Both matter, but a 4728 for a privileged domain group has a far wider blast radius.

Why does Event 4732 show a SID instead of a group name?

Some collection paths cannot resolve the SID at the time the event is written, particularly for built-in groups or when the account is from another domain. The well-known SID S-1-5-32-544 is the local Administrators group — resolve these in your queries or you will miss the events you most care about.

Is Backup Operators as dangerous as Administrators?

In practice, close to it. Backup Operators can read and write any file on the machine regardless of its permissions, which includes the files that hold credentials. It attracts much less attention than Administrators, which is exactly why it is worth watching.

Mentioned by

Vendor documentation

Last reviewed 28 August 2026