Skip to main content
AD Academy
Back to all events
4732Security (DC / member server)Groups & rightsCRITLast updated:

Member added to a local group (e.g. Administrators)

What it means

Adding to the local Administrators group on a server or PC — a quiet way to gain control without touching Domain Admins.

First steps

  1. 1Note which machine and which user was added.
  2. 2Enforce local group membership via GPO (Restricted Groups) and LAPS.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.