Event-o-Pedia EventID 4745 - A security-disabled local group was changed.

	Event Details
	User Activity->Account Management->Account Changes->Group Account Changes->Windows 2008->EventID 4745 - A security-disabled local group was changed.

EventID 4745 - A security-disabled local group was changed.

Linked Event:

EventID 4745 - A security-disabled local group was changed.

Sample:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/28/2009 8:31:03 PM
Event ID:      4745
Task Category: Distribution Group Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      dcc1.Logistics.corp
Description:   
A security-disabled local group was changed.
Subject:
	Security ID:		S-1-5-21-1135140816-2109348461-2107143693-500
	Account Name:		ALebovsky
	Account Domain:		LOGISTICS
	Logon ID:		0x2a88a
Group:
	Security ID:		S-1-5-21-1135140816-2109348461-2107143693-1157
	Group Name:		Employees_distrib
	Group Domain:		LOGISTICS
Changed Attributes:
	SAM Account Name:	-
	SID History:		-
Additional Information:
	Privileges:		-

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows Vista (2008) Windows 7 (2008 R2) Windows 8 (2012) Windows 8.1 (2012 R2) Windows 10 (2016)
Category	Account Management
Source	Microsoft-Windows-Security-Auditing
TaskCategory	Distribution Group Management
EventId	4745

Field Matching

Field	Description	Stored in	Sample Value
When	At what date and time a user activity originated in the system.	DateTime
Who	Account or user name under which the activity occured.	Subject: Account Name	ALebovsky
What	The type of activity occurred (e.g. Logon, Password Changed, etc.)	"Group Changed"	Group Changed
Where	The name of the workstation/server where the activity was logged.	Computer
Where From	The name of the workstation/server where the activity was initiated from.	-	10.10.10.10
Severity	Specify the seriousness of the event.	"High"	High
WhoDomain		Subject: Account Domain	LOGISTICS
WhereDomain		-
Whom	Account or user name being managed.	Group: Security ID	S-1-5-21-1135140816-2109348461-2107143693-1157
Group Type	Type of group: security or distribution.	"Distribution"	Distribution
Group Scope	Scope of group: local, global, universal.	"Local"	Local
Group Name		Group: Group Name	Employees_distrib
Group Domain		Group: Group Domain	LOGISTICS
Affected Group		InsertionString3	S-1-5-21-1135140816-2109348461-2107143693-1157
SAM Account Name		Changed Attributes: SAM Account Name	-
SID History		Changed Attributes: SID History	-