User removed from a universal security group.
Removing members from Enterprise Admins, Universal security groups can sabotage access controls or degrade monitoring.
Alert: removal from Enterprise Admins or forest-wide privileged groups.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4757 // A member was removed from a security-enabled universal group
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4757
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A member was removed from a security-enabled universal group — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A member was removed from a security-enabled universal group. User removed from a universal security group.
Event 4757 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Alert: removal from Enterprise Admins or forest-wide privileged groups.