Skip to content

Commit 9791d9c

Browse files
Merge pull request #3667 from martin77s/patch-19
Update remote-calls-sam.md
2 parents 1d116c4 + 0410412 commit 9791d9c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

ATPDocs/deploy/remote-calls-sam.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ ms.topic: how-to
1010
Microsoft Defender for Identity mapping for [potential lateral movement paths](/defender-for-identity/understand-lateral-movement-paths) relies on queries that identify local admins on specific machines. These queries are performed with the SAM-R protocol, using the Defender for Identity [Directory Service account](directory-service-accounts.md) you configured.
1111

1212
> [!NOTE]
13-
> This feature can potentially be exploited by an adversary to obtain the Net-NTLM hash of the DSA account due to a Windows limitation in the SAM-R calls that allows downgrading from Kerberos to NTLM.
13+
> This feature can potentially be exploited by an adversary to obtain the NTLM hash of the DSA account due to a Windows limitation in the SAM-R calls that allows downgrading from Kerberos to NTLM.
1414
> The new Defender for Identity sensor (version 3.x) is not affected by this issue as it uses different detection methods.
1515
>
1616
> It is recommended to use a [low privileged DSA account](directory-service-accounts.md#grant-required-dsa-permissions). You can also [contact support](../support.md) to open a case and request to completely disable the [Lateral Movement Paths](../security-assessment-riskiest-lmp.md) data collection capability.

0 commit comments

Comments
 (0)