The ACL was set on accounts which are members of administrators groups.


Subject:
Security ID: %4
Account Name: %5
Account Domain: %6
Logon ID: %7

Target Account:
Security ID: %3
Account Name: %1
Account Domain: %2

Additional Information:
Privileges: %8

Every hour, the Windows domain controller that holds the primary domain controller (PDC) Flexible Single Master Operation (FSMO) role compares the ACL on all security principal accounts (users, groups, and machine accounts) present for its domain in Active Directory and that are in administrative groups against the ACL on the AdminSDHolder object. If the ACL on the principal account differs from the ACL on the AdminSDHolder object, then the ACL on the principal account is reset to match the ACL on the AdminSDHolder object and this event is generated.