Distribution Group Management in Windows System

There are various tasks that can be performed in Distribution Group Management

• A distribution group is created, changed, or deleted.
• A member is added to or removed from a distribution group.

The volume of this event being generated is low and is logged only on domain controllers. And by default this events are not configured to be logged by Microsoft. However, if this policy setting is configured, it determines what tasks are performed in Distribution Group Management.

Following are the lists of event that gets generated

eventId description

4744 A security-disabled local group was created.

4745 A security-disabled local group was changed.

4746 A member was added to a security-disabled local group.

4747 A member was removed from a security-disabled local group.

4748 A security-disabled local group was deleted.

4749 A security-disabled global group was created.

4750 A security-disabled global group was changed.

4751 A member was added to a security-disabled global group.

4752 A member was removed from a security-disabled global group.

4753 A security-disabled global group was deleted.

4759 A security-disabled universal group was created.

4760 A security-disabled universal group was changed.

4761 A member was added to a security-disabled universal group.

4762 A member was removed from a security-disabled universal group.

How should these events be looked in SIEM tool?

Alert rules. Rules can be specific to above mentioned eventId or generic to Application Group Management like

LogSource=Windows eventId IN [4744, 4745, 4746, 4747, 4748, 4749, 4750, 4751, 4752, 4753, 4759, 4760, 4761, 4762]

What fields to monitor?

timestamp, who performed, security group, operationType

AD - Security and Distribution Group

When creating a group in Microsoft Active Directory you are given two options to choose from. One Security and the other is distribution. These two groups serves different purpose and it is vital to understand the purpose before you create a group. Let's look what these groups allows you to do.

Security Group
- Allows you to manage user and computer access to shared resources.
- Allows you to control who receives group policy settings.
- Allows you to set permissions once on multiple computers, then change the membership of the group as your needs change.
- Also, allows you to use these groups as email distribution lists.

Distribution Group
- Distribution groups are intended to be used as email distribution lists and used with applications such as Microsoft Exchange or Outlook. This group allows you to add and remove contacts from the list so that they will or will not receive email sent to the distribution group.
- However, you will not be able to use distribution groups for the purpose of assigning permissions on any objects. Also, you can't use them to filter group policy settings.