Log Windows Firewall drops and successes to separate paths
Use Configure Windows Firewall logging to review this narrow operational decision without extending the source beyond its stated scope.
Read the briefingDSE security knowledge hubIT
IT
Knowledge
Page 17 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Explore this topic
Start with the cornerstone guide IT knowledge center
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
DSE post stream
429 articlesIT
Preserve UAC token boundaries in privileged workflows
Use How User Account Control works to review this narrow operational decision without extending the source beyond its stated scope.
Read the checklist
Deploy the vulnerable driver blocklist through supported App Control
Use Microsoft recommended driver block rules to review this narrow operational decision without extending the source beyond its stated scope.
Read the explainer
Keep RDP credentials off the target with Remote Credential Guard
Use Remote Credential Guard to review this narrow operational decision without extending the source beyond its stated scope.
Read the guide
Plan Defender for Identity sensor coverage by server role
Use Microsoft Defender for Identity deployment overview to review this narrow operational decision without extending the source beyond its stated scope.
Read the playbook
Activate Defender for Identity sensor v3 only after its prerequisite checks
Use Deploy the Defender for Identity sensor v3.x to review this narrow operational decision without extending the source beyond its stated scope.
Read the briefing
Choose automatic or manual sensor activation from the domain-controller inventory
Use Activate the Defender for Identity sensor v3.x on a domain controller to review this narrow operational decision without extending the source beyond its stated scope.
Read the checklist
Keep Defender for Identity sensor v2 scope to legacy controllers and non-DC identity roles
Use Microsoft Defender for Identity sensor v2.x prerequisites to review this narrow operational decision without extending the source beyond its stated scope.
Read the explainer
Size Defender for Identity sensor v2 separately from sensor v3
Use Plan capacity for Microsoft Defender for Identity deployment to review this narrow operational decision without extending the source beyond its stated scope.
Read the guide
Model every Active Directory forest in one Defender for Identity monitoring plan
Use Microsoft Defender for Identity multi-forest considerations to review this narrow operational decision without extending the source beyond its stated scope.
Read the playbook