๐ Secure Bits ๐ก
๐๐๐๐ผ๐บ๐ฎ๐๐ถ๐ฐ ๐ช๐ถ๐ป๐ฑ๐ผ๐๐ ๐ฎ๐๐ฑ๐ถ๐๐ถ๐ป๐ด ๐ถ๐ป ๐๐ฒ๐ณ๐ฒ๐ป๐ฑ๐ฒ๐ฟ ๐ณ๐ผ๐ฟ ๐๐ฑ๐ฒ๐ป๐๐ถ๐๐ ๐ป๐ผ๐ ๐ด๐ผ๐ฒ๐ ๐ฏ๐ฒ๐๐ผ๐ป๐ฑ ๐ฑ๐ผ๐บ๐ฎ๐ถ๐ป ๐ฐ๐ผ๐ป๐๐ฟ๐ผ๐น๐น๐ฒ๐ฟ๐
You can now enable Windows event auditing on ๐๐ ๐๐ฆ, ๐๐ ๐๐ฆ and ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ ๐๐ป๐๐ฟ๐ฎ ๐๐ผ๐ป๐ป๐ฒ๐ฐ๐ servers automatically. The servers have to run the ๐๐ฒ๐ป๐๐ผ๐ฟ ๐๐ฏ.๐ to get the audit configuration automatically.
๐ ๏ธ ๐ช๐ต๐ฒ๐ฟ๐ฒ ๐๐ผ ๐๐๐ฟ๐ป ๐ถ๐ ๐ผ๐ป:
Microsoft Defender portal โ Settings โ Identities โ General โ Advanced features โ ๐๐๐๐ผ๐บ๐ฎ๐๐ถ๐ฐ ๐ช๐ถ๐ป๐ฑ๐ผ๐๐ ๐ฎ๐๐ฑ๐ถ๐๐ถ๐ป๐ด ๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฎ๐๐ถ๐ผ๐ป
๐ช๐ต๐ฎ๐ ๐๐ต๐ฒ ๐๐ฒ๐ป๐๐ผ๐ฟ ๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฒ๐:
– Directory services advanced auditing: audit entries in the SACL of the domain root object
– NTLM auditing: the required registry values
– Domain object auditing: the SACL on the Configuration partition
– AD FS: object-level auditing on the AD FS configuration container, plus the Audit Application Generated policy (Success and Failure)
– AD CS: the required value in the CA audit filter in the CA registry configuration
– Entra Connect: the Audit Logon policy (Success and Failure)
– The local Windows audit policies
The sensor writes the settings to the local system policy of the server and repeats the check once every 24 hours.
โ ๏ธ ๐๐ฒ๐ณ๐ผ๐ฟ๐ฒ ๐๐ผ๐ ๐๐๐ฟ๐ป ๐ถ๐ ๐ผ๐ป:
– AD FS: event auditing in AD FS Management and verbose logging stay manual (Set-AdfsProperties -AuditLevel Verbose)
– If Sensor v2.x is still in use, you have to do it manually
– GPO settings can conflict with the local settings that the sensor applies
๐ ๐๐ต๐ฒ๐ฐ๐ธ ๐๐ผ๐๐ฟ ๐ฐ๐๐ฟ๐ฟ๐ฒ๐ป๐ ๐๐๐ฎ๐๐ฒ ๐ณ๐ถ๐ฟ๐๐:
New-MDIConfigurationReport -Path “C:Reports” -Mode Domain -OpenHtmlReport
(DefenderForIdentity PowerShell module)
Do your AD FS, AD CS and Entra Connect servers already run the v3.x sensor?
Author: Martin Strnad
