Review domain health, sensor coverage, policy, and trust relationships together
The Active Directory domain page brings domain health, sensor coverage, security policies, trust relationships, and recommendations into one view.
Read the checklistDSE security knowledge hubIT
IT
Knowledge
Page 129 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide IT knowledge center
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
DSE post stream
1,513 articlesIT
Interpret Defender for Identity detections as correlated behavioral signals
Defender for Identity monitors signals from on-premises Active Directory, Microsoft Entra ID, and other IAM systems such as Okta, analyzing them with behavioral analytics, threat intelligence, and known attack patterns.
Read the explainer
Remove Entra Connect replication rights only when Password Hash Sync does not need them
The Microsoft Entra Connect express installation grants replication permissions to the AD DS Connector account, and Microsoft recommends removing unnecessary permissions when Password Hash Sync is not configured.
Read the guide
Disable an enabled domain Guest account surfaced by identity infrastructure assessments
The identity-infrastructure assessment includes a recommendation that identifies whether an Active Directory Guest account is enabled. The stated goal of that recommendation is for the domain Guest account not to be enabled.
Read the playbook
Require RPC packet privacy on AD CS enrollment interfaces flagged as ESC11
AD CS certificate enrollment can use the MS-ICPR RPC interface, whose certification-authority settings determine whether packet privacy is required.
Read the briefing
Remove standard-user modification rights from Group Policy objects
The assessment lists Group Policy objects that standard users can modify and states that this condition can lead to domain compromise. Microsoft notes that attackers can inspect Group Policy settings to identify weaknesses, security controls, and potential exploit paths.
Read the checklist
Investigate Active Directory accounts with no logon in 90 days
The stale-account recommendation lists Active Directory user accounts that have not logged in during the previous 90 days. The page says impacted entities can update within minutes after remediation while assessment scores and statuses update every 24 hours.
Read the explainer
Connect each identity provider before relying on cloud-identity posture assessments
Defender for Identity provides cloud-identity assessments for Okta, CyberArk Identity, and SailPoint Identity Security Cloud. Microsoft requires the relevant provider instance to be connected in the Defender portal before its assessments are used.
Read the guide
Use Defender for Identity alerts for detections, not complete audit history
Defender for Identity alerts describe suspicious activities and identify involved actors and computers with direct evidence links.
Read the playbook
Review patch evidence before tuning classic Defender for Identity alerts
Classic and Defender-format alerts use detections from Defender for Identity sensors but differ as part of the transition to a unified alerting experience.
Read the briefing