# Active Directory Auditing Tool

[https://www.manageengine.com/products/active-directory-audit/account-management-events/event-id-4729.html](https://www.manageengine.com/products/active-directory-audit/account-management-events/event-id-4729.html)

## Event ID 4729 - A member was removed from a security-enabled global group

<div class="tabCont" id="bkmrk-event-id-4729-catego"><table><tbody><tr><td>**Event ID**</td><td>4729</td></tr><tr><td>**Category**</td><td>Account management</td></tr><tr><td>**Sub category**</td><td>Security group management</td></tr><tr><td>**Description**</td><td>A member was removed from a security-enabled global group</td></tr></tbody></table>

</div>When Active Directory objects such as an user/group/computer is removed from a security group, event ID 4729 gets logged.

This log data gives the following information:

<div class="tabCont" id="bkmrk-subject%3A-user-who-pe"><table><tbody><tr><td>Subject: User who performed the action</td><td>Security ID  
Account Name  
Account Domain  
Logon ID</td></tr><tr><td>Member: Object removed from the security group</td><td>Security ID  
Account Name </td></tr><tr><td>Group: Security group from which the object was removed</td><td>Security ID  
Group Name  
Group Domain</td></tr><tr><td>Additional Information</td><td>Privileges</td></tr></tbody></table>

</div>### Why event ID 4729 needs to be monitored?

<div class="tabCont" id="bkmrk-prevention-of-privil">- Prevention of privilege abuse
- Detection of potential malicious activity
- Operational purposes like getting information on user activity like user attendance, peak logon times, etc.
- Compliance mandates

</div>### Pro tip:

ADAudit Plus audits, reports, and alerts group management actions performed on distribution and security groups making Active Directory auditing much easier.

Event 4729 applies to the following operating systems:

<div class="noteBx" id="bkmrk-windows-server-2008-">- Windows Server 2008 R2 and Windows 7
- Windows Server 2012 R2 and Windows 8.1
- Windows Server 2016 and Windows 10

</div>Corresponding event ID for 4729 in Windows Server 2003 and older is 633