In this article  :

• Objective

• Prerequisites

• Steps to follow

• Validation and confirmation

• Tips

• Related topics and articles

Objective  

This article explains how to track when a user was removed from a security group using ManageEngine ADAudit Plus. It helps detect unauthorized additions, ensure compliance with access control policies, and maintain a clear audit trail of group membership changes.

Prerequisites  

• Ensure Audit Security Group Management is enabled on the Default Domain Controller Policy.

• Ensure that Audit Directory Service Changes is enabled on the Default Domain Controller Policy to capture events related to event ID 5137.

• Object-level auditing for group objects must be configured to ensure that events are logged whenever any activity related to Active Directory objects occurs.

Steps to follow  

1. Log in to ADAudit Plus as an admin or with a technician account.

2. Navigate to Active Directory > Group Management > Recently Removed Members from Security Groups.

3. Click Advanced Search above the reports.

1. Select Member Name as a variable.

2. Choose Contains as a condition.

3. Enter the username in the Enter Search Value text box.

4. Click Search to display relevant results.

5. The reports can further be filtered using the following:

• Specific user or group name

• Time range

• Domain controller or OU

Event IDs to look for (If validating in the Event Viewer)  

Validation and confirmation  

• Verify that the removed user appears in the Recently Removed Members from Security Groups report.

• Test by removing a user from a security group and checking if it appears in the report.

Tips

• Regularly review group management reports for unauthorized changes.

• Schedule the report to run daily or weekly and email it to security administrators.

• Regularly review high-privilege group changes (e.g., domain admins or enterprise admins).

• Consider setting up real-time alerts in ADAudit Plus for critical group membership changes.

Related Topics and Articles  

• How to configure a custom alert to receive alerts for group membership changes