Hello.
When you use the ACS (SCOM2012 sp1) encounter this problem:
In the report, "Security Sensitive Groups Changes" no information on changes to the universal group.If a local group or a global - change data is available in full.
I found the info about the event with number 4756 not correctly written to the ACS database (table AdtServer.dvAll5).Fields PrimaryUser, ClientUser, ClientSid, ClientDomain not have value.
Can someone help fix ACS to write events to database and receive adequate 4756 in the report "Sensitive Security Groups Changes"?