Event ID 4799 shows that a process enumerated members of a security-enabled local group. That can reveal privilege targeting, reconnaissance, or administrative tooling use. Monitor the Group Name, Account Name, Process Name and Process ID, and look for unexpected enumeration on sensitive hosts. It requires the Audit Security Group Management subcategory.
What Event ID 4799 tells you about local privilege activity
Event ID 4799 is valuable because it records a concrete administrative visibility event, not just a generic Windows audit signal. When a process enumerates members of a security-enabled local group, it can indicate someone is mapping permissions, checking for privileged targets, or using administrative tooling. The event becomes more meaningful when the host is sensitive or when the same account repeats the action across multiple systems.
That makes the event useful for distinguishing routine administration from reconnaissance patterns. A single query may be benign, but unexpected group enumeration on a server, jump host, or other high-value endpoint can be the first observable sign that someone is preparing follow-on access or validating which accounts are worth targeting next.
What to look at in the event record
The most useful fields are the ones that let you connect the enumeration to a person, process, and host context. Group Name tells you which local group was queried, Account Name shows who or what initiated the action, and Process Name and Process ID show the executable responsible. If you can tie those fields to a known management workflow, the event is easier to dismiss; if you cannot, it deserves follow-up.
Correlation matters more than the event in isolation. Compare the event against recent logons, remote administration sessions, scheduled task activity, and any nearby privilege changes. A security team should also ask whether the process name is expected for that asset, because the same action can mean very different things when it comes from a built-in admin tool, a script host, or an unfamiliar binary.
Why this event matters operationally
Event ID 4799 helps you spot the kind of low-noise activity that often sits just before privilege abuse or lateral movement. It is especially useful on systems where local group membership is tightly controlled, because repeated enumeration can reveal which identities may have elevated access paths, which systems are worth targeting, and whether an operator is verifying group composition before making changes.
For defensive monitoring, this event is most useful when combined with broader Windows audit coverage. NHIMG’s Windows Event Log Guide is the best companion reference when you want to place 4799 beside the other event IDs that usually define account, logon, and group-management activity. For process-level context, the Sysmon Guide helps you connect the event to executable lineage, while the SIEM Guide is useful for turning repeated enumeration into a reliable detection pattern.
Risk and Threat Considerations
Local group enumeration is a small action with outsized value to an attacker because it reduces uncertainty. Once an adversary can see which accounts sit in a security-enabled group, they can prioritize escalation, identify administrative relationships, and look for gaps between intended access and actual membership.
Failure mechanism: The control only helps if the event is collected, retained, and reviewed in context. If logging is incomplete, or if the environment generates so much administrative noise that 4799 is never triaged, reconnaissance can blend into normal operations and no one notices the access mapping.
Impact: Missed 4799 activity can delay detection of privilege targeting, weaken investigations into suspicious admin behavior, and leave defenders with poor visibility into how group membership is being enumerated on sensitive systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | 4799 is a monitorable security event that supports anomaly detection on sensitive hosts. |
| Recommendation — Correlate 4799 with adjacent events to detect suspicious group enumeration patterns. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | The event is only useful if audit records are reviewed and analyzed for suspicious enumeration. |
| AU-12 — Audit Record Generation | 4799 depends on generating the relevant Windows audit record in the first place. | |
| AC-6 — Least Privilege | Group enumeration can expose overbroad access paths that least privilege should limit. | |
| Recommendation — Review 4799 audit records for unexpected local group enumeration on sensitive systems. Enable the audit subcategory needed to generate 4799 evidence consistently. Use 4799 findings to validate and reduce unnecessary local group access paths. | ||
| MITRE ATT&CK | T1069.001 — Permission Groups Discovery: Local Groups | 4799 directly reflects local group discovery activity commonly used in reconnaissance. |
| T1087.001 — Account Discovery: Local Account | Local membership enumeration often supports account discovery and privilege targeting. | |
| Recommendation — Map 4799 to local group discovery and hunt for related reconnaissance activity. Link repeated 4799 activity to broader account discovery behavior and follow-on escalation. | ||
Practitioner Guidance
What to verify: Confirm that 4799 is enabled through the relevant audit policy and that your log pipeline preserves the Group Name, Account Name, Process Name, and Process ID fields. If those fields are missing or truncated, the event is far less useful for triage.
Decision rule: Treat repeated or unexplained enumeration on servers, privileged workstations, or domain-adjacent systems as a higher-priority signal than the same activity on a managed admin host. If the process is unfamiliar, correlate it with recent logon activity and nearby group-change events before deciding it is benign.
Practitioner takeaway: Event ID 4799 is most valuable when you treat it as evidence of permission mapping, not as a standalone alert. Its real security value comes from context, repetition, and whether the enumerating process fits the expected administration pattern for that host.