What information do you need to monitor for the Local Security Groups? There's some Event ID's that specifically related to Local Security Groups, for example Event ID 4732 will tell you that a user has been added to a local security group. You you then build filters in SEM to capture those events, and include the group name in the filter also if needed.
↧