Windows Event ID 4733: A member was removed from a security-enabled local group
Windows Security Event ID 4733 records removal of a member from a security-enabled local group.
- Applicable version
- Windows Server 2008 and later where the audit subcategory is enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft documents that this event is generated for each removed member on domain controllers, member servers, and workstations.
Key Fields
Member Security ID / Account Name
The principal removed from the local security group; Account Name may be - for some local-group cases.
Group Name / Group Domain
The local group affected; compare Group Domain to Computer to distinguish local SAM and domain local groups.
Subject Logon ID / Privileges
Actor session and any privilege list associated with the removal.
Common False Positives
- Group Policy Preferences and endpoint management can enforce local Administrators membership and remove unmanaged principals.
- Deprovisioning and access review processes remove users from privileged local groups.
Related Events
MITRE ATT&CK Mapping
- T1098Account Manipulation
Detection Notes
Alert on threshold=1 removal from Administrators, Remote Desktop Users, Backup Operators, or other privileged local groups outside an approved endpoint-management cycle. Microsoft documents 4733 per removed member and notes 4735 often precedes it without details; a suspicious actor can remove competing administrators or cleanup evidence of earlier T1098 Account Manipulation. Correlate Subject Logon ID with 4624/4688 and compare Group Domain to Computer for local SAM scope.
SecurityEvent
| where EventID == 4733
| project TimeGenerated, Computer, Account, MemberName, GroupName, GroupDomainindex=wineventlog EventCode=4733 | table _time, host, Account_Name, Member_Account_Name, Group_Name, Group_DomainEventID: 4733
Subject Account Name: admin.ops
Subject Logon ID: 0x27a79
Member Security ID: S-1-5-21-111-222-333-1109
Member Account Name: CN=helpdesk,CN=Users,DC=corp,DC=local
Group Name: Administrators
Group Domain: HOST01