Skip to main content
AD Academy
Back to all events
4729Security (DC)Groups & rightsWARNLast updated:

Member removed from a global group

What it means

The inverse of 4728. Matters in two cases: an employee leaving, or an attacker cleaning up after abusing a privilege.

First steps

  1. 1Check for a 4728 earlier the same day with the same account — a temporary add for abuse.
  2. 2Confirm the removal is backed by a helpdesk ticket.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.