UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 4732 - A member was added to a security-enabled local group / Account Name shown as a Dash ( - ) in Event Event 4732 | 4733 | 4746 | 4747 / Latest Posts

RE: Account Name shown as a Dash ( - ) in Event Event 4732 | 4733 | 4746 | 4747

JavierC — Thu, 15 Dec 2011 10:51:05 GMT

Hi,

Event 4732 are generated with "local groups" and "domain local groups".

On local groups only show field "security id" with "Sid" or Netbios Account Name if server can translate (99%)

On Domain Local Groups: Use Field "security ID" with "Sid" or Netbios Account Name and field "Account Name" with LDAP Distinguised Name.

Regards

Javier Carrera

RE: Account Name shown as a Dash ( - ) in Event Event 4732 | 4733 | 4746 | 4747

louwine — Wed, 30 Nov 2011 06:09:59 GMT

The logon name is "testaccount". For the display name (I suppose this is the full name), it is also "testaccount".

RE: Account Name shown as a Dash ( - ) in Event Event 4732 | 4733 | 4746 | 4747

RandyFranklinSmith — Tue, 29 Nov 2011 09:32:39 GMT

Wierd, for that user account, what is it's logon name and display name?

RE: Account Name shown as a Dash ( - ) in Event Event 4732 | 4733 | 4746 | 4747

louwine — Thu, 24 Nov 2011 08:01:37 GMT

I know this thread had been inactive for a while, but I noticed that this issue still occurs. Event screenshots are attached.

General View: 11-24-2011 8-55-16 PM.gif

Details View: 11-24-2011 8-47-06 PM.gif

RE: Account Name shown as a Dash ( - ) in Event Event 4732 | 4733 | 4746 | 4747

Braino — Fri, 23 Oct 2009 12:43:18 GMT

Hey SteveB - are you referring to the "user" field? Please post a screenshot.

Thanks!

RE: Account Name shown as a Dash ( - ) in Event Event 4732 | 4733 | 4746 | 4747

RandyFranklinSmith — Thu, 27 Aug 2009 10:24:08 GMT

can you email/post some examples?

Account Name shown as a Dash ( - ) in Event Event 4732 | 4733 | 4746 | 4747

SteveB — Thu, 06 Aug 2009 17:14:22 GMT

Event 4732 | 4733 | 4746 | 4747

Why not return the name of the user who has been added to / or removed from a Local Group? Yes, it's provided in the Security ID... provided the tool you are using translates the SID. If not, you are forced to do a SID lookup to know who was added or removed from the group.

I would like to know why the Account Name is being returned as a Dash ( - )?

Or, is it a bug?

-SteveB