> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/04-active-directory-security-monitoring/monitor-domain-admins-membership.md).

# Monitor Domain Admins Membership Changes

This lab demonstrates why privileged group membership is one of the most important Active Directory changes to monitor.

## Objective

Temporarily add a dedicated test user to the `Domain Admins` group, verify the related event, then remove the user and verify the removal event.

## Safety Note

Perform this exercise only inside the isolated ZyberLab environment.

Do not use your normal lab user for this test. Use the temporary account `tempuser01` and remove it from `Domain Admins` immediately after generating the required event.

## Add the Test User

On `DC01`:

1. Open **Active Directory Users and Computers**.
2. Open the **Users** container.
3. Open the `Domain Admins` group.
4. Select the **Members** tab.
5. Add `tempuser01`.
6. Apply the change.

## Find the Event

Because `Domain Admins` is normally a global security group, filter the Security log for:

```
4728
```

Find the newest event related to `Domain Admins`.

Review:

* the account that made the change
* the affected group
* the member that was added
* the event time

## Remove the Test User Immediately

Return to the `Domain Admins` group and remove `tempuser01`.

Then filter for:

```
4729
```

Confirm that the removal event appears.

## Verify the Final State

Open the `Domain Admins` group again and confirm that `tempuser01` is no longer a member.

This cleanup step is part of the lab, not an optional task.

## Security Relevance

Membership in `Domain Admins` provides extensive control over the Active Directory domain. An unexpected addition can represent privilege escalation, persistence, account compromise, or unauthorized administration.

A high-value detection should therefore identify additions to critical groups quickly and include enough context to answer who made the change, which account received the privilege, and whether the activity was approved.