I am working on a potential issue internally where someone has access to add users to groups for email distribution purposes. I've recently been finding that their AD help desk group has the Administrators group added to it, which it should not be. I've removed this twice now and the group keeps being re-added. My daily AD change email doesn't pick this addition up for some reason, but it does show when I remove the group. I assumed that logs were being deleted to cover tracks, but I then discovered this entry in the event viewer:

A member was added to a security-enabled local group.

    Security ID:        SYSTEM
    Account Name:       BACKUPDC$
    Account Domain:     DOMAIN
    Logon ID:           0x3e7

    Security ID:        DOMAIN\help_desk
    Account Name:       -

    Security ID:        BUILTIN\Administrators
    Group Name:         Administrators
    Group Domain:       Builtin

Additional Information:
    Privileges:     -

I did some testing myself and found that when I added that group membership with my admin account a proper event was generated showing my account along with the destination group and the group that was added like you would expect.

Am I correct in my assumption that logs are being removed (by the user in question), or could this be some sort of weird logon script or something that is generating these membership changes?

  • I've answered my own question, though in a roundabout way. I was looking through Group Policies after deleting this group, so I could add the new group to the local administrative privilege policy. I found Computer -> Policies -> Windows -> Security -> Restricted Groups was set to make that original help_desk group a member of Administrators and Remote Desktop Users; the same two that had been re-appearing. I'm guessing that every time GP refreshed that would get re-added to the existing group. The rub is now that I cannot remember doing that, but I can't prove anyone else did either. – Sqrl May 19 '18 at 16:19
  • Found the original article I used: community.spiceworks.com/how_to/… – Sqrl May 19 '18 at 16:21
  • That explains it. Just a misconfiguration on my part. – Sqrl May 19 '18 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.