Event Details
User Activity->Account Management->Group Membership Changes->Active Roles 7 or higher->EventID 1525 - Members added to group.
EventID 1525 - Members added to group.
Group Member Added
 Sample: 
Log Name:      ARAdminService
Source:        ARAdminSvc
Date:          11/22/2016 3:18:03 PM
Event ID:      1525
Task Category: GroupMembershipChange
Level:         Information
Keywords:      Classic,Audit Success
User:          ITSS\igor.ilyin
Computer:      IIZHU1.itss.wm.zhu.cn.qsft
Description:
Members added to group. 
Operation GUID: 43cb2dfb-4517-4844-b7d1-d04327510bff 
Group name: InTrust.Admins 
Parent container: itss.wm.zhu.cn.qsft/OOUU 
Group object GUID: 5396bcb6-84ba-47a4-b143-aba050497ee0 
Members: 
CN=Grant Zhu,OU=OOUU,DC=itss,DC=wm,DC=zhu,DC=cn,DC=qsft
CN=Shawn.Huang,OU=OOUU,DC=itss,DC=wm,DC=zhu,DC=cn,DC=qsft
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: ARAdminService
Filtering Field Equals to Value
Source ARAdminSvc
EventId 1525
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. - 1/1/2000
Who Account or user name under which the activity occured. User RESEARCH\Alebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Group Member Added" Group Member Added
Where The name of the workstation/server where the activity was logged. - 10.10.10.10
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. - High
WhoDomain -
WhereDomain -
Whom Account or user name being managed. Whom
Member Name Account name of added/removed group member InsertionString5
Group Type The type of group: security or distribution. -
Group Scope The scope of group: local, global, universal -
Group Name Group name
Group Domain -
Comments
You must be logged in to comment