| Event Id | 4749 |
| Source | Microsoft-Windows-Security-Auditing |
| Description | A security-disabled global group was created. Subject: Security ID:<Security ID> Account Name:<Account Name> Account Domain:<Domain name> Logon ID: <Logon ID> Group: Security ID:<Security ID> Group Name:<Group Name> Group Domain:<Group Domain> Attributes: SAM Account Name:<SAM Account Name> SID History:<SID History> Additional Information: Privileges: |
| Event Information | Cause : The user can create a Global Distribution group identified in New Group.This event is only logged on domain controllers. Resolution : No user action is required. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.