SharePoint 2016 ; Event ID 4733 - A member was removed from a security-enabled local group

[Tamang]

Hello,

I get a bunch of security events with ID 4733 - A member was removed from a security-enabled local group every day.

Account spfarm adding and removing an account NT AUTHORITY\NETWORK SERVICE to BUILTIN\IIS_IUSRS group automatically.

Subject : 

  Security ID: domain\spfarm
  Account Name : spfarm
  Account Domain : domain

  Logon ID : 0xEA56AA40

Member :

 Security ID : NT AUTHORITY\NETWORK SERVICE

Group :

 Security ID : BUILTIN\IIS_IUSRS

 Group Name : IIS_IUSRS

 Group Domain : Builtin

IA is not happy about these events. Could not figure out why this is happening? Is there any way to not let spfarm account perform the above action automatically?

Thanks,

[#2 · Accepted solution]

Best answer provided by Trevor Seward:
https://social.technet.microsoft.com/Forums/en-US/1d451db9-fc73-4b1a-a532-7e89be2888ee/sharepoint-au...