Direct answer
Review the member, local group, actor and device associated with event 4732, then compare the change with the approved access request and intended group permissions.
Identify the change
Microsoft documents event 4732 for a member added to a security-enabled local group. Record the device, subject, target group, member identifier and time. Determine whether the group is privileged in that environment rather than judging from its name alone.
Reference: Microsoft: Security event 4732.
Check the source and request
Compare the actor and timing with an authorized support ticket, deployment policy and change window. A management tool can make legitimate changes under a service identity. Confirm the physical device and effective group membership, including any directory group represented by the added member.
Investigate a concrete case
A temporary vendor support group added to local Administrators for an approved migration may be expected during the change. Verify its documented expiry and membership with the identity owner. An unexplained broad group on unrelated devices requires escalation and a review of policy assignments.
Restore and verify
Preserve evidence before removing unauthorized access, and retain a tested recovery path. Correct the responsible management policy as well as the local membership if appropriate, then check again after policy refresh. Record what the member could access and any uncertainty in the finding.
Assessment limits
A membership event does not prove the new access was used or describe every effective privilege. Nested directory groups and policy refresh require separate review.
Frequently asked questions
Does 4732 prove a member used administrator access?
No. It records a group addition; investigate logons and actions separately.
Can a managed policy add the member again?
Yes. Identify the controlling assignment before relying on a local removal.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.