> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/04-active-directory-security-monitoring/monitor-security-group-membership.md).

# Monitor Security Group Membership Changes

This lab adds and removes a user from a normal Active Directory security group, then reviews the events created on the domain controller.

## Objective

Understand how Windows records group membership changes and learn the common event IDs used for different group scopes.

## Common Group Membership Event IDs

| Group Type                  | Member Added | Member Removed |
| --------------------------- | ------------ | -------------- |
| Global security group       | 4728         | 4729           |
| Domain local security group | 4732         | 4733           |
| Universal security group    | 4756         | 4757           |

For this beginner lab, use the global security group created earlier in ZyberLab.

## Add the Test User to the Group

On `DC01`:

1. Open **Active Directory Users and Computers**.
2. Locate the security group created in the Active Directory Basics section.
3. Open the group properties.
4. Select the **Members** tab.
5. Add `tempuser01`.
6. Apply the change.

## Find the Add Event

Open:

**Event Viewer > Windows Logs > Security**

If the group is a global security group, filter for:

```
4728
```

Open the newest matching event.

Review:

* who made the change
* which group was changed
* which member was added
* when the change occurred

## Remove the Test User

Return to the group properties and remove `tempuser01` from the group.

Then filter the Security log for:

```
4729
```

Review the newest matching event.

## Verification

The lab is complete when you can identify both the add and remove events and connect them to the manual actions you performed.

## Security Relevance

Group membership often determines access to systems, files, applications, and administrative capabilities. Monitoring membership changes helps identify unauthorized privilege assignment and unexpected access changes.