A security engineer is deploying a SIEM and needs to onboard Windows Domain Controller logs. Which Windows Security event category must be enabled via Group Policy to capture user account management events such as group membership changes?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the Audit Account Management policy generates events for user account and group changes including Event ID 4728/4732 (group membership additions), 4720 (account creation), and 4726 (account deletion), which are captured under the Account Management audit category in Group Policy. A is wrong because Audit Process Creation generates Event ID 4688 for process launches, not account management events.
Full explanation below image
Full Explanation
B is correct because the Audit Account Management policy generates events for user account and group changes including Event ID 4728/4732 (group membership additions), 4720 (account creation), and 4726 (account deletion), which are captured under the Account Management audit category in Group Policy. A is wrong because Audit Process Creation generates Event ID 4688 for process launches, not account management events. C is wrong because Audit Logon Events captures authentication events (4624, 4625) not account management changes. D is wrong because Audit Object Access captures file, registry, and SAM object access attempts, not account management operations.