| Event Id | 639 |
| Source | Security |
| Description | Security Enabled Local Group Changed:
Target Account Name: <Target Account Name>
Target Domain: <Target Domain>
Target Account ID: <Target Account ID>
Caller User Name: <Caller User Name>
Caller Domain: <Caller Domain>
Caller Logon ID: <Caller Logon ID>
Privileges: <Privileges>
Changed Attributes:
Sam Account Name: <Sam Account Name>
Sid History: <Sid History>
|
| Event Information | According to Microsoft:
Cause :
This event record indicates that a change (other than group membership) has been made to a local group. There is no Failure Audit form of this audit event record. Group changes can have security implications.
Resolution :
The person with administrative rights for the computer should check to make sure there are no security implications for the change.
-------------------------------------------------------------------------------------------------
Cause:
This event record indicates that a change (other than group membership) has been made to a local group. There is no Failure Audit form of this audit event record. Group changes can have security implications. |
| Reference Links | Event ID 639 from Source Security
Alternate Event ID in Vista and Windows Server 2008 is 4735.
|
