AD Group enumeration events were generated by servicenow ,mid server and discovery service accounts executing net1.exe
wanted to know more details here when and why service account execute net1.exe also why it query AD environment for listings of groups, user accounts, etc
