Event ID 4799 is a Windows Security audit event for enumeration of a security-enabled local group membership on the computer. It does not cover enumeration through Active Directory Users and Computers. Investigate the process name and ID when this appears unexpectedly, as it can indicate local recon or discovery of privileged groups.
What Event ID 4799 tells you
Event ID 4799 is a Windows Security audit event that records enumeration of membership in a security-enabled local group on the computer. It is a visibility signal, not a finding by itself, and the key question is whether the access came from a routine administrative workflow or unexpected local discovery activity.
Because the event reflects local group enumeration, it can surface benign administration, endpoint tooling, or software inventory activity. It becomes more meaningful when the timing, host, process, or user context does not match expected administration, especially on systems that should have little interactive access.
Why local group enumeration matters
Local group membership tells an actor who has administrative or other elevated rights on the endpoint. Enumerating that membership helps an attacker or curious insider identify privilege targets, spot misconfigured groups, and plan the next step in lateral movement or privilege abuse.
The event is useful because it captures discovery at the point where an actor is mapping the local trust boundary. A single read of group membership can support reconnaissance, but repeated or clustered events across hosts may indicate active discovery rather than normal administration.
How to interpret process and host context
When this event appears unexpectedly, the process name and process ID are often the most important triage clues. A known management agent, help desk tool, or security product may explain the event, but an unfamiliar binary, an unusual parent process, or an unexpected account should raise scrutiny.
Host context matters as well. On a workstation used by administrators, occasional enumeration may be routine. On a server, a sensitive endpoint, or a system with tightly restricted local access, the same event can indicate someone probing who can administer the machine and which group names may be worth targeting next.
Detection value and investigation workflow
Event ID 4799 is best used alongside other Windows audit and telemetry sources so you can distinguish scheduled administration from suspicious discovery. Windows Event Log Guide helps place this event in the broader Windows audit picture, while Sysmon Guide helps correlate the process tree, image path, and related execution activity that produced it.
That correlation is what turns the event into a useful signal. The goal is to answer who enumerated the group, from what process, on which endpoint, and whether the same activity aligns with logon patterns, privileged session use, or nearby administrative change.
Risk and Threat Considerations
Unexpected local group enumeration can indicate reconnaissance for privilege escalation or lateral movement, especially when it is followed by logons, service creation, or privilege checks. The risk is highest where local administrators are few, where endpoints host sensitive data, or where group membership reveals operational trust relationships.
Failure mechanism: An attacker or insider uses legitimate directory or local security APIs to enumerate privileged local groups, then uses the resulting map of accounts and roles to choose a target for escalation, impersonation, or persistence.
Impact: Exposure of privileged local access paths can shorten the time to compromise, make stealthier targeting easier, and increase the likelihood that follow-on activity blends into normal Windows administration.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Event 4799 is an audit record that depends on security logging coverage. |
| AU-6 — Audit Record Review, Analysis, and Reporting | This event only helps when reviewed and correlated with process context. | |
| AC-6 — Least Privilege | Local group enumeration becomes more sensitive where excess local privilege exists. | |
| Recommendation — Enable audit generation for local group membership enumeration and forward those events to monitoring. Review 4799 events with nearby process and logon telemetry to separate administration from discovery. Restrict local administrative membership so enumeration reveals less exploitable privilege structure. | ||
| MITRE ATT&CK | T1069.001 — Permission Groups Discovery: Local Groups | The event directly reflects discovery of local security groups on a host. |
| Recommendation — Map recurring 4799 activity to local-group discovery and investigate adjacent escalation or lateral movement. | ||
| CIS Controls v8 | CIS-5 — Account Management | Local group membership is an account and privilege control surface. |
| Recommendation — Inventory and review privileged local group membership so discovery events reflect authorized administration only. | ||
Practitioner Guidance
What to watch for: Treat the event as benign only when the process, user, host, and timing match an approved administrative pattern. If any of those elements are off, validate the originating process, confirm the operator, and compare the event with nearby logons, script activity, and remote management traces.
Governance implication: Define which tools and accounts are allowed to enumerate local groups, then review whether that access is justified on each class of system. On sensitive endpoints, the most effective response is often to reduce standing administrative exposure so group discovery is less revealing in the first place.