Microsoft Defender for Identity sensor is installed and healthy on every domain controller

Overview

Microsoft Defender for Identity protects on-premises Active Directory by monitoring authentication and directory traffic at every domain controller. Sensors installed on domain controllers analyze LDAP queries, Kerberos and NTLM authentications, DNS queries, and Active Directory replication traffic to detect identity attacks such as Kerberoasting, Pass-the-Hash, Pass-the-Ticket, DCSync, credential dumping, and lateral movement.

Because every domain controller is authoritative for the full domain, a single unmonitored domain controller creates a blind spot large enough for an attacker to extract credentials for every account in the domain without generating an MDI alert. An outdated, disconnected, or unhealthy sensor produces the same blind spot as a missing one. Sensor coverage must therefore be complete — every domain controller must have a sensor in a healthy, up-to-date, and running state.

Remediation

To install or repair the MDI sensor on a domain controller:

1. Sign in to Microsoft Defender XDR as a Global Administrator or Security Administrator.
2. Navigate to Settings > Identities > Sensors.
3. Download the sensor installer and follow Install the Microsoft Defender for Identity sensor.
4. For outdated sensors, see Update Microsoft Defender for Identity sensors.
5. For unhealthy sensors, review Microsoft Defender for Identity health alerts.

• Plan capacity for Microsoft Defender for Identity
• Install the Microsoft Defender for Identity sensor
• Configure Microsoft Defender for Identity sensor settings
• Update Microsoft Defender for Identity sensors
• Microsoft Defender for Identity health alerts
• Troubleshoot Microsoft Defender for Identity sensor failures

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	SecOps
Category	Identity threat protection
Product	Defender
Feature	Defender for Identity
Area	Logging and detection
ATT&CK	T1558.003 Kerberoasting, T1550.002 Pass the Hash, T1550.003 Pass the Ticket, T1003.006 DCSync
Licence	ATA
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.