Skip to main content
AD Academy
Back to all events
4756Security (DC)Groups & rightsCRITLast updated:

Member added to a universal group

What it means

Universal groups include Enterprise Admins and Schema Admins — the strongest privileges in the forest.

First steps

  1. 1Any addition to Enterprise/Schema Admins is an immediate alert, even if planned.
  2. 2Match it to an approved change request; if none, remove and investigate.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.