Windows event ID 4788 - A non-member was removed from a basic application group

Event ID: 

4788

Category: 

Account Management

Subcategory: 

Application Group Management

Supported on: 

Windows Vista, Windows Server 2008

A non-member was removed from a basic application group.

Subject:
Security ID: %6
Account Name: %7
Account Domain: %8
Logon ID: %9

Member:
Security ID: %2
Account Name: %1

Group:
Security ID: %5
Account Name: %3
Account Domain: %4

Additional Information:
Privileges: %10

A non-member is an account that is explicitly excluded from membership in a basic application group. Even if the account is specified as a member of the application group, either explicitly or through nested group membership, the account will not be treated as a group member if it is listed as a non-member.

Related content