Group membership information at logon

What it means

Logged together with 4624 and lists the groups the user belonged to at logon. It shows at a glance when someone with Domain Admins rights signs in.

First steps

1. 1Link it to 4624 by Logon ID.
2. 2Look for sensitive groups (Domain Admins, Enterprise Admins) on ordinary machines.
3. 3An admin logon on a workstation risks hash theft (Pass-the-Hash).