<div>
Take the guessing out of the equation and install a change reporter.<br />
<a href="http://www.netwrix.com/active_directory_change_reporting_freeware.html" rel="ugc">http://www.netwrix.com/active_directory_change_reporting_freeware.html</a><br />
<br />
It will tell you who is making the changes.
</div>


<div>
<div class="content wysiwyg-content">
I am seeing this Security event periodically. &nbsp;It is removing a domain account from the local admin for a specific windows 2008 R2 server.<br />
Some Admin group accounts are being removed and readded programatically.<br />
Some are being removed and not readded. &nbsp;Why is this occuring?<br />
Where do I look?<br />
It is causing my ADRMS services to not work.<br />
<br />
<br />
A member was removed from a security-enabled local group.<br />
<br />
Subject:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Security ID: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SYSTEM<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Account Name: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0NH1C8P02$<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Account Domain: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MYCOMPANY<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Logon ID: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0x3e7<br />
<br />
Member:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Security ID: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MYCOMPANY\_adrmsadmin<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Account Name: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-<br />
<br />
Group:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Security ID: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;BUILTIN\Administrators<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Group Name: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Administrators<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Group Domain: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Builtin<br />
<br />
Additional Information:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Privileges: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-
</div>
</div>


I am seeing this Security event periodically.  It is removing a domain account from the local admin for a specific windows 2008 R2 server.
Some Admin group accounts are being removed and readded programatically.
Some are being removed and not readded.  Why is this occuring?
Where do I look?
It is causing my ADRMS services to not work.


A member was removed from a security-enabled local group.

Subject:
	Security ID:		SYSTEM
	Account Name:		0NH1C8P02$
	Account Domain:		MYCOMPANY
	Logon ID:		0x3e7

Member:
	Security ID:		MYCOMPANY\_adrmsadmin
	Account Name:		-

Group:
	Security ID:		BUILTIN\Administrators
	Group Name:		Administrators
	Group Domain:		Builtin

Additional Information:
	Privileges:		-

Why is &quot;A member was removed from a security-enabled local group.&quot; being removed

Windows Server 2008 and Windows Server 2008 R2, based on the Microsoft Vista codebase, is the last 32-bit server operating system released by Microsoft. It has a number of versions, including including Foundation, Standard, Enterprise, Datacenter, Web, HPC Server, Itanium and Storage; new features included server core installation and Hyper-V.

Windows Server 2008

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.

Why is &quot;A member was removed from a security-enabled local group.&quot; being removed

Why is "A member was removed from a security-enabled local group." being removed