No Windows security event is generated for adding a user account to local administrators'group

[Windows 11]

Hello,I noticed that on some client endpoints, when someone adds a local or domain joined account to local administrators' group, no event entry (with ID 4732,4735) is generated for it. I searched a lot and checked group policy settings and installed software like syslog forwarders but couldn't find any symptoms why this happens.

Continue reading...