Defender for Identity - Directory Services Advanced Auditing is not enabled

Question

Defender for Identity - Directory Services Advanced Auditing is not enabled

OwlTecAB 60

Hi Everyone,

We have followed the following guide from Microsoft in regards to enabling "advanced auditing" for Defender for Identity:

https://learn.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection However, we keep getting this health issue notification within the portal:

Screenshot 2023-09-27 at 1.52.25 PM

Any ideas?

I am certain have configured our GPO properly (but you never know):

Screenshot 2023-09-27 at 1.34.51 PM

Screenshot 2023-09-27 at 1.35.28 PM

Screenshot 2023-09-27 at 1.35.41 PM

Screenshot 2023-09-27 at 1.35.54 PM

Screenshot 2023-09-27 at 1.36.44 PM

Screenshot 2023-09-27 at 1.46.40 PM

Here are the results of running "auditpol /get /category:*" on one of the servers that this policy has been applied to:

Screenshot 2023-09-27 at 2.13.04 PM

Screenshot 2023-09-27 at 2.13.14 PM

As always, thanks for the help!

OwlTecAB 60 Reputation points

2023-09-28T13:29:09.2533333+00:00
I just ran the Test-MdiReadiness.ps1 script:

https://github.com/microsoft/Microsoft-Defender-for-Identity/tree/main/Test-MdiReadiness

And in the corresponding .JSON file I have this error message:

"AdvancedAuditingDetails": "Unable to get the advanced auditing settings remotely"

I am starting to think that the issue is with the sensor itself and not my GPO policies because I ran this script locally on a DC.

Edit: I opened a issue ticket with the script creators to see if they have any insights:
https://github.com/microsoft/Microsoft-Defender-for-Identity/issues/7

Edit 2: Running the script was flagged by "Microsoft Defender for Identity" which never happened before so I wonder if the sensors are working now properly since I changed the policies to run out of "Default Domain Controllers Policy" GPO.
OwlTecAB 60 Reputation points

2023-09-28T15:04:43.08+00:00

Just made some headway with this issue; the auditing policies are on and there is an issue with the sensor not being able to see that the auditing policies are turned on.

I had a look at the previously shared script above and found out what policies that had to be turned on:

Policy Target,Subcategory,Subcategory GUID,Inclusion Setting,Setting Value System,Security System Extension,{0CCE9211-69AE-11D9-BED3-505054503030},Success and Failure,3 System,Distribution Group Management,{0CCE9238-69AE-11D9-BED3-505054503030},Success and Failure,3 System,Security Group Management,{0CCE9237-69AE-11D9-BED3-505054503030},Success and Failure,3 System,Computer Account Management,{0CCE9236-69AE-11D9-BED3-505054503030},Success and Failure,3 System,User Account Management,{0CCE9235-69AE-11D9-BED3-505054503030},Success and Failure,3 System,Directory Service Access,{0CCE923B-69AE-11D9-BED3-505054503030},Success and Failure,3 System,Directory Service Changes,{0CCE923C-69AE-11D9-BED3-505054503030},Success and Failure,3 System,Credential Validation,{0CCE923F-69AE-11D9-BED3-505054503030},Success and Failure,3

Here is the results of AuditPol on my one DC (which shows that the required policies are enabled):

Machine Name,Policy Target,Subcategory,Subcategory GUID,Inclusion Setting,Exclusion Setting,Setting Value DomainController,System,IPsec Driver,{0CCE9213-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,System Integrity,{0CCE9212-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Security System Extension,{0CCE9211-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Security State Change,{0CCE9210-69AE-11D9-BED3-505054503030},Success,,1 DomainController,System,Other System Events,{0CCE9214-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Group Membership,{0CCE9249-69AE-11D9-BED3-505054503030},Success,,1 DomainController,System,User / Device Claims,{0CCE9247-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Network Policy Server,{0CCE9243-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Other Logon/Logoff Events,{0CCE921C-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Special Logon,{0CCE921B-69AE-11D9-BED3-505054503030},Success,,1 DomainController,System,IPsec Extended Mode,{0CCE921A-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,IPsec Quick Mode,{0CCE9219-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,IPsec Main Mode,{0CCE9218-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Account Lockout,{0CCE9217-69AE-11D9-BED3-505054503030},Failure,,2 DomainController,System,Logoff,{0CCE9216-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Logon,{0CCE9215-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Handle Manipulation,{0CCE9223-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Central Policy Staging,{0CCE9246-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Removable Storage,{0CCE9245-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Detailed File Share,{0CCE9244-69AE-11D9-BED3-505054503030},Failure,,2 DomainController,System,Other Object Access Events,{0CCE9227-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Filtering Platform Connection,{0CCE9226-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Filtering Platform Packet Drop,{0CCE9225-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,File Share,{0CCE9224-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Application Generated,{0CCE9222-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Certification Services,{0CCE9221-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,SAM,{0CCE9220-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Kernel Object,{0CCE921F-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Registry,{0CCE921E-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,File System,{0CCE921D-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Other Privilege Use Events,{0CCE922A-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Non Sensitive Privilege Use,{0CCE9229-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Sensitive Privilege Use,{0CCE9228-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,RPC Events,{0CCE922E-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Token Right Adjusted Events,{0CCE924A-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Process Creation,{0CCE922B-69AE-11D9-BED3-505054503030},Success,,1 DomainController,System,Process Termination,{0CCE922C-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Plug and Play Events,{0CCE9248-69AE-11D9-BED3-505054503030},Success,,1 DomainController,System,DPAPI Activity,{0CCE922D-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Other Policy Change Events,{0CCE9234-69AE-11D9-BED3-505054503030},Failure,,2 DomainController,System,Authentication Policy Change,{0CCE9230-69AE-11D9-BED3-505054503030},Success,,1 DomainController,System,Audit Policy Change,{0CCE922F-69AE-11D9-BED3-505054503030},Success,,1 DomainController,System,Filtering Platform Policy Change,{0CCE9233-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Authorization Policy Change,{0CCE9231-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,MPSSVC Rule-Level Policy Change,{0CCE9232-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Other Account Management Events,{0CCE923A-69AE-11D9-BED3-505054503030},Success,,1 DomainController,System,Application Group Management,{0CCE9239-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Distribution Group Management,{0CCE9238-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Security Group Management,{0CCE9237-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Computer Account Management,{0CCE9236-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,User Account Management,{0CCE9235-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Directory Service Replication,{0CCE923D-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Directory Service Access,{0CCE923B-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Detailed Directory Service Replication,{0CCE923E-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Directory Service Changes,{0CCE923C-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Other Account Logon Events,{0CCE9241-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Kerberos Service Ticket Operations,{0CCE9240-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,System,Credential Validation,{0CCE923F-69AE-11D9-BED3-505054503030},Success and Failure,,3 DomainController,System,Kerberos Authentication Service,{0CCE9242-69AE-11D9-BED3-505054503030},No Auditing,,0 DomainController,,Option:CrashOnAuditFail,,Disabled,,0 DomainController,,Option:FullPrivilegeAuditing,,Disabled,,0 DomainController,,Option:AuditBaseObjects,,Disabled,,0 DomainController,,Option:AuditBaseDirectories,,Disabled,,0 DomainController,,FileGlobalSacl,,,, DomainController,,RegistryGlobalSacl,,,,
OwlTecAB 60 Reputation points

2023-09-28T15:47:41.02+00:00

Opened a ticket with Microsoft support, will see what they say.

2 answers

Your answer

OwlTecAB 60 Reputation points

2023-09-28T13:29:09.2533333+00:00

I just ran the Test-MdiReadiness.ps1 script:

https://github.com/microsoft/Microsoft-Defender-for-Identity/tree/main/Test-MdiReadiness

And in the corresponding .JSON file I have this error message:

"AdvancedAuditingDetails": "Unable to get the advanced auditing settings remotely"

I am starting to think that the issue is with the sensor itself and not my GPO policies because I ran this script locally on a DC.

Edit: I opened a issue ticket with the script creators to see if they have any insights:
https://github.com/microsoft/Microsoft-Defender-for-Identity/issues/7

Edit 2: Running the script was flagged by "Microsoft Defender for Identity" which never happened before so I wonder if the sensors are working now properly since I changed the policies to run out of "Default Domain Controllers Policy" GPO.
OwlTecAB 60 Reputation points

2023-09-28T15:47:41.02+00:00

Opened a ticket with Microsoft support, will see what they say.

Answer 1

Limitless Technology 44,666

Hello

Thank you for your question and reaching out.

Please check below steps and make sure you have checked all relevant event log entries to be enabled for GPO.

https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-enabling-advanced-security-audit-policy-via/ba-p/282452

--If the reply is helpful, please Upvote and Accept as answer--

OwlTecAB 60 Reputation points

2023-09-28T13:23:33.24+00:00

Duplicate.

Answer 2

OwlTecAB 60

Thanks for the link, however I have just confirmed that the relevant logs are on found on my DCs (that was applied via my GPO): Screenshot 2023-09-28 at 7.17.26 AM

Screenshot 2023-09-28 at 7.14.05 AM

Screenshot 2023-09-28 at 7.15.28 AM

What I just did, was push the policies again from the "Default Domain Controllers Policy" GPO instead of the separate one I had created to see if that fixes the issue.

Edit: Pushing the polices to "Default Domain Controllers Policy" GPO, instead of a separate GPO, is what fixed it. I guess this is a super common bug with enabling Advanced Audit that has been resolved.

art_domingues 0 Reputation points

2024-07-24T02:58:24.73+00:00

Hi, how are you doing?

Did you just run "gpupdate /force" as domain administrator on an elevated terminal on the domain controller to push the policy from the "Default Domain Controllers Policy"?

I'm facing the same problem that you describe (I've made all configurations exacly as you described/show from the pictures above), but I'm already using the "Default Domain Controllers Policy" GPO to enable the advanced auditing (as sugested on the official documentation). Though, I'm still facing the error
art_domingues 0 Reputation points

2024-07-24T02:58:55.71+00:00

Duplicate question
Florent OLLIVIER 0 Reputation points

2024-09-09T08:44:46.1233333+00:00

In my case, I've got another GPO with success audit only, I've add failure audit and it's Ok now
Carlton Whitmore 1 Reputation point

2025-02-28T14:55:10.81+00:00

Thanks OwITecAB. Pushing the polices to "Default Domain Controllers Policy" GPO fixed it.

Share via

Defender for Identity - Directory Services Advanced Auditing is not enabled

2 answers

Your answer