How to track changes in the local administrators group?

Question

Zabbix

There are several servers where domain users are in the local administrators group.
It is required to monitor changes in the Local Admins group. So that new admins do not appear.
How can this be done through ZABBIX?

PS. Also do not say that it is not necessary to give the rights of administrators. I know! And this is my sore spot. But alas, not everything is decided by system administrators. The problem is that users, having received the rights, begin to create gag. I would like to track it somehow.
If you have any other advice, I'd be very grateful.

Answer 1

Zabbix Agent can also look into Windows system logs - you can catch events 4732 (adding to a group) and / or 4733 (removing from a group) on servers in the Security Log, whose TargetSid is equal to S-1-5-32-544

Answer 2

Restrict membership in the local admins group by group policy.