Pre windows 2008. For windows 2008 and after, the event id changes. See <http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=632>
And related entries. Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com From: Malcolm Reitz [mailto:[email protected]] Sent: Monday, May 24, 2010 5:38 PM To: NT System Admin Issues Subject: RE: Domain membership change There's not a specific event for Domain Admins group membership. You'll have to look for the 632 security event and filter on the description containing substring "Domain Admins". -Malcolm From: David Lum [mailto:[email protected]] Sent: Monday, May 24, 2010 16:03 To: NT System Admin Issues Subject: Domain membership change If I wanted to get notified anytime a user is added to say, Domain Admins, what's the best way to go about this? Is there an EventID I can look for? David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
