Event Details
User Activity->Account Management->Group Membership Changes->Active Roles 7 or higher->EventID 1526 - Members removed from group.
EventID 1526 - Members removed from group.
Group Member Removed
 Sample: 
Log Name:      ARAdminService
Source:        ARAdminSvc
Date:          11/22/2016 3:17:41 PM
Event ID:      1526
Task Category: GroupMembershipChange
Level:         Information
Keywords:      Classic,Audit Success
User:          ITSS\igor.ilyin
Computer:      IIZHU1.itss.wm.zhu.cn.qsft
Description:
Members removed from group. 
Operation GUID: e639dee8-8876-4f5b-8758-7ade903f6e4d 
Group name: InTrust.Admins 
Parent container: itss.wm.zhu.cn.qsft/OOUU 
Group object GUID: 5396bcb6-84ba-47a4-b143-aba050497ee0 
Members: 
CN=Grant Zhu,OU=OOUU,DC=itss,DC=wm,DC=zhu,DC=cn,DC=qsft
CN=Shawn.Huang,OU=OOUU,DC=itss,DC=wm,DC=zhu,DC=cn,DC=qsft
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: ARAdminService
Filtering Field Equals to Value
Source ARAdminSvc
EventId 1526
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. - 1/1/2000
Who Account or user name under which the activity occured. User RESEARCH\Alebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Group Member Removed" Group Member Removed
Where The name of the workstation/server where the activity was logged. - 10.10.10.10
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. - High
WhoDomain -
WhereDomain -
Whom Account or user name being managed. Whom
Member Name Account name of added/removed group member InsertionString5
Group Type The type of group: security or distribution. -
Group Scope The scope of group: local, global, universal -
Group Name Group name
Group Domain -
Comments
You must be logged in to comment