Event-o-Pedia EventID 4734 - A security-enabled local group was deleted.

	Event Details
	User Activity->Account Management->Account Changes->Group Account Changes->Windows 2008->EventID 4734 - A security-enabled local group was deleted.

EventID 4734 - A security-enabled local group was deleted.

Linked Event:

EventID 4734 - A security-enabled local group was deleted.

Sample:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/28/2009 8:31:03 PM
Event ID:      4734
Task Category: Security Group Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      dcc1.Logistics.corp
Description:   
A security-enabled local group was deleted.

Subject:
	Security ID:		S-1-5-21-1135140816-2109348461-2107143693-500
	Account Name:		ALebovsky
	Account Domain:		LOGISTICS
	Logon ID:		0x2a88a

Group:
	Security ID:		S-1-5-21-1135140816-2109348461-2107143693-1154
	Group Name:		Accounting__local
	Group Domain:		LOGISTICS

Additional Information:
	Privileges:		-

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows Vista (2008) Windows 7 (2008 R2) Windows 8 (2012) Windows 8.1 (2012 R2) Windows 10 (2016)
Category	Account Management
Source	Microsoft-Windows-Security-Auditing
TaskCategory	Security Group Management
EventId	4734

Field Matching

Field	Description	Stored in	Sample Value
When	At what date and time a user activity originated in the system.	DateTime	10.10.2000 19:00:00
Who	Account or user name under which the activity occured.	Subject: Account Name	ALebovsky
What	The type of activity occurred (e.g. Logon, Password Changed, etc.)	"Group Deleted"	Group Deleted
Where	The name of the workstation/server where the activity was logged.	Computer	DC1
Where From	The name of the workstation/server where the activity was initiated from.	-	10.10.10.10
Severity	Specify the seriousness of the event.	"High"	High
WhoDomain		Subject: Account Domain	LOGISTICS
WhereDomain		-
Whom	Account or user name being managed.	Group: Security ID	S-1-5-21-1135140816-2109348461-2107143693-1154
Group Type	Type of group: security or distribution.	"Security"	Security
Group Scope	Scope of group: local, global, universal.	"Local"	Local
Group Name		Group: Group Name	Accounting__local
Group Domain		Group: Group Domain	LOGISTICS
Affected Group		InsertionString3	S-1-5-21-1135140816-2109348461-2107143693-1154