# Microsoft Defender for Identity sensor is installed and healthy on every domain controller
Microsoft Defender for Identity protects on-premises Active Directory by monitoring authentication and directory traffic at every domain controller.
Source: https://maester.dev/docs/tests/ZTA.41002
## Overview
Microsoft Defender for Identity protects on-premises Active Directory by monitoring authentication and directory traffic at every domain controller. Sensors installed on domain controllers analyze LDAP queries, Kerberos and NTLM authentications, DNS queries, and Active Directory replication traffic to detect identity attacks such as Kerberoasting, Pass-the-Hash, Pass-the-Ticket, DCSync, credential dumping, and lateral movement.
Because every domain controller is authoritative for the full domain, a single unmonitored domain controller creates a blind spot large enough for an attacker to extract credentials for every account in the domain without generating an MDI alert. An outdated, disconnected, or unhealthy sensor produces the same blind spot as a missing one. Sensor coverage must therefore be complete — every domain controller must have a sensor in a healthy, up-to-date, and running state.
## Remediation
To install or repair the MDI sensor on a domain controller:
1. Sign in to [Microsoft Defender XDR](https://security.microsoft.com) as a Global Administrator or Security Administrator.
2. Navigate to **Settings > Identities > Sensors**.
3. Download the sensor installer and follow [Install the Microsoft Defender for Identity sensor](https://learn.microsoft.com/en-us/defender-for-identity/deploy/install-sensor).
4. For outdated sensors, see [Update Microsoft Defender for Identity sensors](https://learn.microsoft.com/en-us/defender-for-identity/sensor-settings#update-sensors).
5. For unhealthy sensors, review [Microsoft Defender for Identity health alerts](https://learn.microsoft.com/en-us/defender-for-identity/health-alerts).
- [Plan capacity for Microsoft Defender for Identity](https://learn.microsoft.com/en-us/defender-for-identity/deploy/capacity-planning)
- [Install the Microsoft Defender for Identity sensor](https://learn.microsoft.com/en-us/defender-for-identity/deploy/install-sensor)
- [Configure Microsoft Defender for Identity sensor settings](https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-sensor-settings)
- [Update Microsoft Defender for Identity sensors](https://learn.microsoft.com/en-us/defender-for-identity/sensor-settings#update-sensors)
- [Microsoft Defender for Identity health alerts](https://learn.microsoft.com/en-us/defender-for-identity/health-alerts)
- [Troubleshoot Microsoft Defender for Identity sensor failures](https://learn.microsoft.com/en-us/defender-for-identity/troubleshooting-known-issues)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Identity threat protection |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Defender for Identity |
| Area | Logging and detection |
| ATT&CK | [T1558.003](/docs/tests?mitre=T1558.003) Kerberoasting, [T1550.002](/docs/tests?mitre=T1550.002) Pass the Hash, [T1550.003](/docs/tests?mitre=T1550.003) Pass the Ticket, [T1003.006](/docs/tests?mitre=T1003.006) DCSync |
| Licence | ATA |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.