> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/07-security-investigation-basics/investigate-privileged-group-change.md).

# Investigate a Privileged Group Change

## Objective

Investigate a membership change involving the `Domain Admins` group and confirm who performed the change, which account was affected, and whether the activity was expected.

## Lab Systems

* `DC01`

## Safety Note

Use only a temporary lab account such as `tempuser01`.

Do not leave the account in `Domain Admins` after the exercise.

## Generate Test Activity

Using Active Directory Users and Computers:

1. Add `tempuser01` to `Domain Admins`.
2. Wait long enough for the audit event to be written.
3. Remove `tempuser01` from `Domain Admins`.

## Find the Evidence

On `DC01`, review the Security log for:

```
4728
4729
```

Event ID `4728` records a member being added to a security-enabled global group.

Event ID `4729` records a member being removed from a security-enabled global group.

## Investigate the Events

For both events, identify:

* account that performed the change
* group that was modified
* member that was added or removed
* domain
* time of the action

Compare the two events to confirm that the temporary privileged access was removed.

## Investigation Questions

1. Which account changed the group?
2. Which user was added?
3. Which privileged group was affected?
4. When was the user removed again?
5. Was the change planned?
6. Does the final membership of `Domain Admins` look correct?

## Example Finding

```
The temporary account tempuser01 was added to Domain Admins by the lab administrator during the planned exercise.
The account was removed shortly afterward.
The final group membership was reviewed and no unintended privileged account remained.
```

## Clean Up

Open `Domain Admins` and verify that `tempuser01` is no longer a member.

Delete the temporary account if it is no longer required for another lab.

## Security Relevance

Privileged group changes are high-value security events because membership can grant broad administrative access.

A useful investigation must confirm the actor, the affected account, the purpose of the change, and the final privileged state.