Security Enabled Local Group Member Added: Member Name: %1 Member ID: %2 Target Account Name: %3 Target Domain: %4 Target Account ID: %5 Caller User Name: %6 Caller Domain: %7 Caller Logon ID: %8 Privileges: %9

Details
Product:	Windows Operating System
Event ID:	636
Source:	Security
Version:	5.0
Component:	Security Event Log
Symbolic Name:	SE_AUDITID_LOCAL_GROUP_ADD
Message:	Security Enabled Local Group Member Added: Member Name: %1 Member ID: %2 Target Account Name: %3 Target Domain: %4 Target Account ID: %5 Caller User Name: %6 Caller Domain: %7 Caller Logon ID: %8 Privileges: %9

Explanation
A user or group account was added to a local security group on the computer or on the domain. The Member Name field specifies the user or group account that was added. The Member ID field specifies the target account security identifier (SID), but this is displayed as the domain-qualified user name by Event Viewer. The Target Account Name and Target Domain fields specify the group to which the user was added. The Target Account ID specifies the security identifier (SID) of the group that was added. The Caller User Name field specifies the user who made the change. The Caller Logon ID field specifies the logon ID of the user who made the change. The Privileges field for this event is usually empty.

User Action
No user action is required.