# Dashboard: Added Members to AD Group **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** windows\ **Created:** [April 26, 2022, 12:03pm UTC](https://community.graylog.org/t/dashboard-added-members-to-ad-group/23580 "2022-04-26T12:03:59Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Hank](https://avatars.discourse-cdn.com/v4/letter/h/f475e1/32.png) [@Hank](https://community.graylog.org/u/Hank)\ **Post date:** [April 26, 2022, 12:03pm UTC](https://community.graylog.org/t/dashboard-added-members-to-ad-group/23580/1 "2022-04-26T12:03:59Z")
Hi, is there a possibility, that i can create a Dashboard which shows me a list of AD Members who were added to a group? I see the EventID 4627 out of the Category Group Membership but there are just the SID´s. Can Graylog lookup these ID´s and compare it to show me a list i can read^^ so that I have an overview about who where added to which group? I am running Graylog (open) v4.2.7 and the Inputs are GELF-UDP THX Hank ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [April 26, 2022, 8:50pm UTC](https://community.graylog.org/t/dashboard-added-members-to-ad-group/23580/2 "2022-04-26T20:50:06Z")
What are you using to ship the logs form the windows machines? Beats? Nxlog? I am not sure how the logs look when shipped to a GELP input… can you post an example message? Does GELF break out fields for you? There are several eventID’s that could occur when a user is added to a group that you have to take into account (4732, 4728, 4756, 4746, 4751, 4761) [Here](https://www.ultimatewindowssecurity.com/securitylog/quickref/Default.aspx) is a quick link to a cheat sheet where you can find more detail… or full details at [ultimate windows security encyclopedia](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/) I have winlogbeats on the windows side going to a beats input. When a user is added to a group I will get the full eventlog and broken out fields such as: User added (distinguished name): `winlog_event_data_MemberName:CN=Tmacgbay,OU=this,OU=that,OU=mainOUgroup,OU=allOUs,DC=domain,DC=tld` Group added to: `winlog_event_data_TargetUserName: Domain Admins` If GELF doesn’t’ have that you may want to consider switching to a more helpful beats environment… if the need for that data exceeds the cost of changing… ---
**Author:** ![Hank](https://avatars.discourse-cdn.com/v4/letter/h/f475e1/32.png) [@Hank](https://community.graylog.org/u/Hank)\ **Post date:** [May 3, 2022, 5:36am UTC](https://community.graylog.org/t/dashboard-added-members-to-ad-group/23580/3 "2022-05-03T05:36:24Z")
Hi, thanks for your input but i dont had time to try it…and now we have a workshop… and after that i will go to holidays. I will try it after that. thx ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [May 3, 2022, 2:17pm UTC](https://community.graylog.org/t/dashboard-added-members-to-ad-group/23580/4 "2022-05-03T14:17:27Z")
No worries - let us know how it turns out when you get to it! ---
**Author:** ![Hank](https://avatars.discourse-cdn.com/v4/letter/h/f475e1/32.png) [@Hank](https://community.graylog.org/u/Hank)\ **Post date:** [May 5, 2022, 12:18pm UTC](https://community.graylog.org/t/dashboard-added-members-to-ad-group/23580/5 "2022-05-05T12:18:42Z")
I could´t resist to try it befor we drive to denmark 😃 With winlogbeat it looks way different and i think thats the way i want. I will kill all GELF inputs and replace them against winlogbeat. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [May 19, 2022, 12:19pm UTC](https://community.graylog.org/t/dashboard-added-members-to-ad-group/23580/6 "2022-05-19T12:19:41Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.