Lenovo Patch: An Error (1332) Occurred While Enumerating the Group Membership. The Member SID Could Not Be Resolved - Lenovo Support US
How to Check Computer Login History on Windows 10/11?
Incident Response: Windows Account Management Event (Part 1) - Hacking Articles
4732(S) A member was added to a security-enabled local group. | Microsoft Learn
Get Local Group Members Revisited • The Lonely Administrator
First Steps After Compromise: Enumerating Active Directory - risk3sixty
Lateral Movement
Get Local Group Members with PowerShell • The Lonely Administrator
How do I disable the AppLogs agent?
EventList – the Baseline Event Analyzer | miriamxyra
Active Directory Domain Enumeration Part-1 With Powerview - NoRed0x
Threat Hunting Using Windows Security Log - Security Investigation
PowerView: Active Directory Enumeration - Red Team Notes
SIEM - Security information and event management — Zercurity 1.6.0 (41f38f0) documentation
Secure workstations by monitoring and alerting on membership changes in the local Administrators group, Part 2 - ManageEngine Blog
BloodHound Inner Workings & Limitations – Part 1: User Rights Enumeration Through SAMR & GPOLocalGroup – Compass Security Blog
Active Directory Group Management Best Practices
4725(S) A user account was disabled. | Microsoft Learn
What is NetBIOS Enumeration? - GeeksforGeeks
Windows admin 101 – Adding a local administrator account from the command line – PwnDefend
Threat Advisory: Telegram Crypto Botnet STRT-TA01 | Splunk
process - what service creates windows security auditing event 4798 in Win 10 - Super User
Active Directory Enumeration detected by Microsoft Security solutions | by Derk van der Woude | Medium
Samir on Twitter: "the cool thing about those 2 newly introducted MS security eventid 4799, 4798 is that they will capture any local group/user discovery attempts even if done via winapis, below
Windows Event Log Analysis - Incident Response Guide
4798(S) A user's local group membership was enumerated. | Microsoft Learn
Event ID 4688: What Is It & How to Enable It - Windows Report
