Page 140 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Windows Firewall rules can allow an application, port, protocol, or predefined traffic type. Inbound and outbound precedence, local policy merge, application rules, and automatic rule creation affect the result.
Read the playbook
Windows Firewall can log dropped packets and successful connections. Microsoft documents configuration through CSP or Group Policy together with parsing and missing-log troubleshooting.
Read the briefing
UAC reduces malware risk by limiting execution with administrator privileges. Applications needing an administrator token prompt for consent, while child processes inherit the parent token only at the same integrity level.
Read the checklist
Attackers can exploit vulnerabilities in legitimate signed kernel drivers to run malicious code in the kernel. Microsoft publishes a vulnerable-driver blocklist that can be applied with App Control mechanisms.
Read the explainer
Remote Credential Guard redirects Kerberos requests to the originating device instead of sending credentials to the RDP target. It protects credentials and derivatives from a compromised target while retaining Remote Desktop single sign-on.
Read the guide
Defender for Identity sensors collect signals from on-premises identity infrastructure for threat detection. The service detects activity such as privilege escalation and high-risk lateral movement and reports exploitable identity issues such as unconstrained Kerberos delegation.
Read the playbook
The sensor v3.x is deployed on supported domain controllers. Microsoft directs administrators to complete prerequisite checks before activation and configure auditing and identity settings afterward.
Read the briefing
Microsoft calls for activating the sensor on all applicable servers and directs older or non-domain-controller identity roles to sensor v2.x instead. Eligible domain controllers can be activated automatically when discovered or manually by selecting servers from the inventory.
Read the checklist
Sensor v2 supports domain controllers running Windows Server 2016 or earlier and AD FS, AD CS, or Microsoft Entra Connect servers that are not domain controllers. For domain controllers running Windows Server 2019 or later, Microsoft recommends sensor v3 instead of sensor v2.
Read the explainer
The capacity planning tool was designed for the resource-intensive network processes of sensor v2.x. Microsoft says sensor v3.x does not require the sizing tool because it relies mainly on Windows events and event tracing and has lower resource requirements.
Read the guide