Skip to main content
AD Academy
Back to all events
4964Security (DC)Security & attacksWARNLast updated:

Special group member logged on

What it means

A mechanism that alerts when a member of a group you defined (e.g. Domain Admins) logs on anywhere.

First steps

  1. 1Register privileged group SIDs in Special Groups Auditing.
  2. 2Alert on admin logons to any host that is not a management server.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.