Event-o-Pedia EventID 4754 - A security-enabled universal group was created.

	Event Details
	User Activity->Account Management->Account Changes->Group Account Changes->Windows 2008->EventID 4754 - A security-enabled universal group was created.

EventID 4754 - A security-enabled universal group was created.

Linked Event:

EventID 4754 - A security-enabled universal group was created.

Sample:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/28/2009 8:31:03 PM
Event ID:      4754
Task Category: Security Group Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      dcc1.Logistics.corp
Description:   
A security-enabled universal group was created.

Subject:
	Security ID:		S-1-5-21-1135140816-2109348461-2107143693-500
	Account Name:		ALebovsky
	Account Domain:		LOGISTICS
	Logon ID:		0x2a88a

Group:
	Security ID:		S-1-5-21-1135140816-2109348461-2107143693-1155
	Group Name:		Employees_univers
	Group Domain:		LOGISTICS

Attributes:
	SAM Account Name:	Employees_univers
	SID History:		-

Additional Information:
	Privileges:		-

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows Vista (2008) Windows 7 (2008 R2) Windows 8 (2012) Windows 8.1 (2012 R2) Windows 10 (2016)
Category	Account Management
Source	Microsoft-Windows-Security-Auditing
TaskCategory	Security Group Management
EventId	4754

Field Matching

Field	Description	Stored in	Sample Value
When	At what date and time a user activity originated in the system.	DateTime	10.10.2000 19:00:00
Who	Account or user name under which the activity occured.	Subject: Account Name	ALebovsky
What	The type of activity occurred (e.g. Logon, Password Changed, etc.)	"Group Created"	Group Created
Where	The name of the workstation/server where the activity was logged.	Computer	DC1
Where From	The name of the workstation/server where the activity was initiated from.	-	10.10.10.10
Severity	Specify the seriousness of the event.	"High"	High
WhoDomain		Subject: Account Domain	LOGISTICS
WhereDomain		-
Whom	Account or user name being managed.	Group: Security ID	S-1-5-21-1135140816-2109348461-2107143693-1155
Group Type	Type of group: security or distribution.	"Security"	Security
Group Scope	Scope of group: local, global, universal.	"Universal"	Universal
Group Name		Group: Group Name	Employees_univers
Group Domain		Group: Group Domain	LOGISTICS
Affected Group		InsertionString3	S-1-5-21-1135140816-2109348461-2107143693-1155
SAM Account Name		Attributes: SAM Account Name	Employees_univers
SID History		Attributes: SID History	-