Skip to content

Commit 29cac0f

Browse files
authored
Update remote-calls-sam.md
added sensor version 3,x to the SAMR note
1 parent 29cc5d3 commit 29cac0f

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

ATPDocs/deploy/remote-calls-sam.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ Microsoft Defender for Identity mapping for [potential lateral movement paths](/
1111

1212
> [!NOTE]
1313
> This feature can potentially be exploited by an adversary to obtain the Net-NTLM hash of the DSA account due to a Windows limitation in the SAM-R calls that allows downgrading from Kerberos to NTLM.
14-
> The new Defender for Identity sensor is not affected by this issue as it uses different detection methods.
14+
> The new Defender for Identity sensor (version 3.x) is not affected by this issue as it uses different detection methods.
1515
>
1616
> It is recommended to use a [low privileged DSA account](directory-service-accounts.md#grant-required-dsa-permissions). You can also [contact support](../support.md) to open a case and request to completely disable the [Lateral Movement Paths](../security-assessment-riskiest-lmp.md) data collection capability.
1717
> Please note that this will result in reduced data available for the [attack path feature in Exposure Management](/security-exposure-management/review-attack-paths).

0 commit comments

Comments
 (0)