Windows Event ID 4729 – A member was removed from a security-enabled global group

When Active Directory objects such as an user/group/computer is removed from a security group, event ID 4729 gets logged.

Subject: User who performed the action	Security ID Account Name Account Domain Logon ID
Member: Object removed from the security group	Security ID Account Name
Group: Security group from which the object was removed	Security ID Group Name Group Domain
Additional Information	Privileges

Why event ID 4729 needs to be monitored?

Prevention of privilege abuse
Detection of potential malicious activity
Operational purposes like getting information on user activity like user attendance, peak logon times, etc.
Compliance mandates

ADAudit Plus audits, reports, and alerts group management actions performed on distribution and security groups making Active Directory auditing much easier.

Event 4729 applies to the following operating systems:

Corresponding event ID for 4729 in Windows Server 2003 and older is 633