Skip to main content
AD Academy
Back to all events
4757Security (DC)Groups & rightsWARNLast updated:

Member removed from a universal group

What it means

Pairs with 4756. In an attack context: covering tracks after using forest-level privileges.

First steps

  1. 1Correlate with the matching 4756.
  2. 2Preserve the log before it rolls over.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.