Windows Event ID 4737 - A security-enabled global group was changed

Event ID	4737
Category	Account management
Sub category	Security group management
Description	A security-enabled global group was changed

When a security global group is changed in Active Directory, event ID 4737 gets logged.

This log data gives the following information:

Subject: User who performed the action	Security ID Account Name Account Domain Logon ID
Group: Changed security global group	Security ID Group Name Group Domain
Attributes	SAM Account Name SID History
Additional Information	Privileges

Why event ID 4737 needs to be monitored?

Prevention of privilege abuse
Detection of potential malicious activity
Operational purposes like getting information on user activity like user attendance, peak logon times, etc.
Compliance mandates

ADAudit Plus audits, reports, and alerts group management actions performed on distribution and security groups making Active Directory auditing much easier.

Event 4737 applies to the following operating systems:

Corresponding event ID for 4737 in Windows Server 2003 and older is 641