4627 Security log · Logon/Logoff info severity medium volume

Windows Event ID 4627 — Group membership information

Group membership enumerated at logon. Supplements 4624 with group list.

Why event 4627 matters

Detect unexpected high-privilege group memberships at logon — an account in Domain Admins that shouldn't be.

How to detect it

Correlate with 4624. Alert: unexpected high-privilege groups in MembershipList.

Log source
Security
Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4627   // Group membership information
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4627
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Group membership information — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4627 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Logon/Logoff events

4624 An account was successfully logged on 4625 An account failed to log on 4626 User/Device claims information 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4649 A replay attack was detected 4672 Special privileges assigned to new logon 4778 A session was reconnected to a Window Station 4779 A session was disconnected from a Window Station 4800 The workstation was locked 4801 The workstation was unlocked

Frequently asked questions

What is Windows Event ID 4627?

Group membership information. Group membership enumerated at logon. Supplements 4624 with group list.

Which log records event 4627?

Event 4627 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

How do you detect activity around event 4627?

Correlate with 4624. Alert: unexpected high-privilege groups in MembershipList.