I am working on a potential issue internally where someone has access to add users to groups for email distribution purposes. I've recently been finding that their AD help desk group has the Administrators group added to it, which it should not be. I've removed this twice now and the group keeps being re-added. My daily AD change email doesn't pick this addition up for some reason, but it does show when I remove the group. I assumed that logs were being deleted to cover tracks, but I then discovered this entry in the event viewer:
A member was added to a security-enabled local group. Subject: Security ID: SYSTEM Account Name: BACKUPDC$ Account Domain: DOMAIN Logon ID: 0x3e7 Member: Security ID: DOMAIN\help_desk Account Name: - Group: Security ID: BUILTIN\Administrators Group Name: Administrators Group Domain: Builtin Additional Information: Privileges: -
I did some testing myself and found that when I added that group membership with my admin account a proper event was generated showing my account along with the destination group and the group that was added like you would expect.
Am I correct in my assumption that logs are being removed (by the user in question), or could this be some sort of weird logon script or something that is generating these membership changes?