> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/account-usage/group-membership/event-id-4799.md).

# Event ID: 4799

Event ID 4799 is a significant security event in Windows environments, signaling "A security-enabled local group membership was enumerated." This event is part of Windows' advanced security auditing capabilities, designed to track and log instances where the membership of sensitive, security-enabled local groups is queried or listed. Monitoring Event ID 4799 is crucial for identifying unauthorized reconnaissance activities that may precede attacks aimed at privilege escalation or lateral movement within a network.

#### Key Details of Event ID 4799

* **Log Location**: Security log.
  * `%SYSTEM ROOT%\System32\winevt\logs\Security.evtx`
* **Category**: Account Logon. 
* **Level**: Information. 

#### When Event ID 4799 Is Logged

Event ID 4799 is generated when a process or user queries the membership of a security-enabled local group. This can occur under various circumstances, including but not limited to:

* Administrative activities involving group management.
* Scripts or applications designed to audit or report on group memberships.
* Potentially malicious activities where an attacker enumerates group memberships to identify targets for privilege escalation.

#### Information Contained in the Event

An Event ID 4799 log includes detailed information that aids in understanding the context and potential implications of the enumerated group membership:

* **Subject**: The account that requested the enumeration. Includes the Security ID (SID), account name, and domain of the user who performed the enumeration.
* **Security Group Information**: Details about the local group that was enumerated, including its name and SID.
* **Caller Process Information**: Identifies the process that initiated the enumeration, including the process ID and name. This is critical for distinguishing between legitimate administrative actions and potentially malicious activities.

#### Security Implications

The logging of Event ID 4799 serves several important purposes in the context of security monitoring and incident response:

* **Reconnaissance Detection**: Frequent or unusual enumeration of group memberships may indicate reconnaissance by attackers seeking to understand the network's security posture.
* **Policy and Compliance**: For organizations subject to regulatory requirements, auditing access to and enumeration of security-sensitive group memberships can be a compliance necessity.
* **Forensic Analysis**: In the aftermath of a security incident, logs of group membership enumeration can provide valuable forensic evidence, helping to reconstruct the sequence of events leading up to a breach.

#### Analysis and Response Strategies

To effectively leverage Event ID 4799 for security purposes, organizations should adopt the following strategies:

* **Baseline Establishment**: Understand normal patterns of group membership enumeration within the environment to identify deviations that could signify malicious activities.
* **Alert Configuration**: Set up alerts for anomalous enumeration activities, especially those involving sensitive groups or performed by unusual or unauthorized processes.
* **Investigation and Remediation**: Follow up on alerts with thorough investigations to determine the nature and intent of the enumeration, applying remediation actions as necessary to address any identified security threats.