Event Details
User Activity->Account Management->Group Membership Changes->Active Roles 7 or higher->EventID 1528 - User removed self from group.
EventID 1528 - User removed self from group.
 Sample: 
Log Name:      ARAdminService
Source:        ARAdminSvc
Date:          11/22/2016 4:29:50 PM
Event ID:      1528
Task Category: SelfGroupMembershipChange
Level:         Information
Keywords:      Classic,Audit Success
User:          ITSS\igor.ilyin
Computer:      IIZHU1.itss.wm.zhu.cn.qsft
Description:
User removed self from group. 
Operation GUID: 4d76d91a-e23b-45fb-b01e-4401dd7825e1 
Group name: InTrust.Admins 
Parent container: itss.wm.zhu.cn.qsft/OOUU 
Group object GUID: 5396bcb6-84ba-47a4-b143-aba050497ee0 
User: CN=igor.ilyin,OU=OOUU,DC=itss,DC=wm,DC=zhu,DC=cn,DC=qsft
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: ARAdminService
Filtering Field Equals to Value
Source ARAdminSvc
EventId 1528
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. - 1/1/2000
Who Account or user name under which the activity occured. User RESEARCH\Alebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "User Removed Self from Group Members" User Removed Self from Group Members
Where The name of the workstation/server where the activity was logged. - 10.10.10.10
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. - High
WhoDomain -
WhereDomain -
Whom Account or user name being managed. Whom
Member Name Account name of added/removed group member InsertionString5
Group Type The type of group: security or distribution. -
Group Scope The scope of group: local, global, universal -
Group Name Group name
Group Domain -
Comments
You must be logged in to comment