You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ATPDocs/deploy/active-directory-federation-services.md
-3Lines changed: 0 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -55,9 +55,6 @@ Configure the SQL server to allow the Directory Service Account with the followi
55
55
-*read*
56
56
-*select*
57
57
58
-
> [!NOTE]
59
-
> If the AD FS database runs on a dedicated SQL server instead of the local AD FS server, and you're using a group Managed Service Account (gMSA) as the Directory Service Account, make sure that you grant the SQL server the [required permissions](create-directory-service-account-gmsa.md#prerequisites-grant-permissions-to-retrieve-the-gmsa-accounts-password) to retrieve the gMSA's password.
60
-
61
58
### Grant access to the AD FS database
62
59
63
60
Grant access to the AD FS database by using SQL Server Management Studio, Transact-SQL (T-SQL), or PowerShell.
Copy file name to clipboardExpand all lines: ATPDocs/deploy/deploy-defender-identity.md
+4-5Lines changed: 4 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -50,9 +50,8 @@ Use the following steps to prepare for deploying Defender for Identity:
50
50
1.[Plan your Defender for Identity capacity](capacity-planning.md).
51
51
52
52
> [!TIP]
53
-
> We recommend running the [*Test-MdiReadiness.ps1*](https://github.com/microsoft/Microsoft-Defender-for-Identity/tree/main/Test-MdiReadiness) script to test and see if your environment has the necessary prerequisites.
54
-
>
55
-
> The link to the *Test-MdiReadiness.ps1* script is also available from Microsoft Defender XDR, on the **Identities > Tools** page (Preview).
53
+
> We recommend running the [*Test-MdiReadiness.ps1*](https://github.com/microsoft/Microsoft-Defender-for-Identity/tree/main/Test-MdiReadiness) script to test and see if the servers in your environment have the necessary prerequisites.
54
+
> You can use the [DefenderForIdentity PowerShell module](https://www.powershellgallery.com/packages/DefenderForIdentity/) to add the required auditing and configure the necessary settings.
56
55
57
56
## Deploy Defender for Identity
58
57
@@ -71,12 +70,12 @@ The following procedures help you complete the deployment process:
71
70
72
71
-[**Enable and configure unified role-based access control (RBAC)**](../role-groups.md) for Defender for Identity.
73
72
74
-
-[**Configure a Directory Service account (DSA) for use with Defender for Identity**](directory-service-accounts.md). While a DSA is optional in some scenarios, we recommend that you configure a DSA for Defender for Identity for full security coverage. For example, when you have a DSA configured, the DSA is used to connect to the domain controller at startup. A DSA can also be used to query the domain controller for data on entities seen in network traffic, monitored events, and monitored ETW activities
73
+
-[**Configure a Directory Service account (DSA) for use with Defender for Identity**](directory-service-accounts.md). While a DSA is optional in some scenarios, we recommend that you configure a DSA for Defender for Identity for full security coverage. For example, when you have a DSA configured, the DSA is used to connect to the domain controller at startup. A DSA can also be used to query the domain controller for data on entities seen in network traffic, monitored events, and monitored ETW activities.
75
74
76
75
-[**Configure remote calls to SAM**](remote-calls-sam.md) as needed. While this step is optional, we recommend that you configure remote calls to SAM-R for lateral movement path detection with Defender for Identity.
77
76
78
77
> [!TIP]
79
-
> By default, Defender for Identity sensors query the directory using LDAP on ports 389 and 3268. To switch to LDAPS on ports 636 and 3269, please open a support case. For more information, see [Microsoft Defender for Identity support](../support.md).
78
+
> By default, Defender for Identity sensors query the directory using LDAP on ports 389 and 3268. To switch to LDAPS on ports 636 and 3269, open a support case. For more information, see [Microsoft Defender for Identity support](../support.md).
Copy file name to clipboardExpand all lines: ATPDocs/monitored-activities.md
+12-10Lines changed: 12 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,18 +14,20 @@ In the case of a valid threat, or **true positive**, Defender for Identity enabl
14
14
The information monitored by Defender for Identity is presented in the form of activities. Defender for Identity currently supports monitoring of the following activity types:
15
15
16
16
> [!NOTE]
17
-
>
18
17
> - This article is relevant for all Defender for Identity sensor types.
19
18
> - Defender for Identity monitored activities appear on both the user and machine profile page.
20
-
> - Defender for Identity monitored activities are also available in Microsoft Defender XDR's [Advanced Hunting](https://security.microsoft.com/advanced-hunting) page.
19
+
> - Defender for Identity monitored activities are also available in [Microsoft Defender XDR's Advanced Hunting](/defender-xdr/advanced-hunting-overview) page.
20
+
21
+
> [!TIP]
22
+
> For detailed information on all supported event types (`ActionType` values) in Advanced Hunting Identity-related tables, use the built-in schema reference available in Microsoft Defender XDR.
21
23
22
24
## Monitored user activities: User account AD attribute changes
23
25
24
26
|Monitored activity|Description|
25
27
|---------------------|------------------|
26
28
|Account Constrained Delegation State Changed|The account state is now enabled or disabled for delegation.|
27
29
|Account Constrained Delegation SPNs Changed|Constrained delegation restricts the services to which the specified server can act on behalf of the user.|
28
-
|Account Delegation Changed | Changes to the account delegation settings |
30
+
|Account Delegation Changed | Changes to the account delegation settings.|
29
31
|Account Disabled Changed|Indicates whether an account is disabled or enabled.|
30
32
|Account Expired|Date when the account expires.|
31
33
|Account Expiry Time Changed|Change to the date when the account expires.|
@@ -35,9 +37,9 @@ The information monitored by Defender for Identity is presented in the form of a
35
37
|Account Password Never Expires Changed|User's password changed to never expire.|
36
38
|Account Password Not Required Changed|User account was changed to allow logging in with a blank password.|
37
39
|Account Smartcard Required Changed|Account changes to require users to log on to a device using a smart card.|
description: This article provides an overview of Microsoft Defender for Identity's Microsoft LAPS usage identity security posture assessment report.
5
4
ms.date: 01/29/2023
@@ -12,9 +11,9 @@ ms.topic: how-to
12
11
13
12
Microsoft's "Local Administrator Password Solution" (LAPS) provides management of local administrator account passwords for domain-joined computers. Passwords are randomized and stored in Active Directory (AD), protected by ACLs, so only eligible users can read it or request its reset.
14
13
15
-
This security assessment supports [legacy Microsoft LAPS](https://www.microsoft.com/en-us/download/details.aspx?id=46899)only.
14
+
This security assessment supports [legacy Microsoft LAPS](https://www.microsoft.com/en-us/download/details.aspx?id=46899)and [Windows LAPS](/windows-server/identity/laps/laps-overview).
16
15
17
-
## What risk does not implementing LAPS pose to an organization?
16
+
## What risk does not implement LAPS pose to an organization?
18
17
19
18
LAPS provides a solution to the issue of using a common local account with an identical password on every computer in a domain. LAPS resolves this issue by setting a different, rotated random password for the common local administrator account on every computer in the domain.
20
19
@@ -24,24 +23,20 @@ LAPS simplifies password management while helping customers implement more recom
24
23
25
24
1. Review the recommended action at <https://security.microsoft.com/securescore?viewid=actions> to discover which of your domains have some (or all) compatible Windows devices that aren't protected by LAPS, or that haven't had their LAPS managed password changed in the last 60 days.
26
25
27
-
28
-
26
+
[](media/cas-isp-laps-1.png#lightbox)
27
+
29
28
1. For domains that are partially protected, select the relevant row to view the list of devices not protected by LAPS in that domain.
30
29
31
30
32
-
33
-
> [!NOTE]
34
-
> If the entire domain is not protected with LAPS, you won't see the list of all the unprotected devices.
35
-
36
-
1. Take appropriate action on those devices by downloading, installing and configuring or troubleshooting [Microsoft LAPS](https://go.microsoft.com/fwlink/?linkid=2104282) using the documentation provided in the download.
31
+
32
+
1. Take appropriate action on those devices by downloading, installing, and configuring or troubleshooting [Microsoft LAPS](https://go.microsoft.com/fwlink/?linkid=2104282) or [Windows LAPS](/windows-server/identity/laps/laps-overview).
37
33
38
34
39
35
40
36
> [!NOTE]
41
-
> While assessments are updated in near real time, scores and statuses are updated every 24 hours. While the list of impacted entities is updated within a few minutes of your implementing the recommendations, the status may still take time until it's marked as **Completed**.
42
-
>
37
+
> While assessments are updated in near real time, scores and statuses are updated every 24 hours. While the list of impacted entities is updated within a few minutes of your implementing the recommendations, the status may still take time until it will be marked as **Completed**.
43
38
44
39
## See also
45
40
46
41
-[Learn more about Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score)
47
-
-[Check out the Defender for Identity forum!](<https://aka.ms/MDIcommunity>)
Copy file name to clipboardExpand all lines: ATPDocs/whats-new.md
+33-1Lines changed: 33 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,6 +22,38 @@ For more information, see also:
22
22
23
23
For updates about versions and features released six months ago or earlier, see the [What's new archive for Microsoft Defender for Identity](whats-new-archive.md).
24
24
25
+
## February 2025
26
+
27
+
### New attack paths tab on the Identity profile page
28
+
29
+
This tab provides visibility into potential attack paths leading to a critical identity or involving it within the path, helping assess security risks. For more information, see [Overview of attack path within Exposure Management.](/security-exposure-management/work-attack-paths-overview)
30
+
31
+
Additional identity page enhancements:
32
+
33
+
- New side panel with more information for each entry on the user timeline.
34
+
35
+
- Filtering capabilities on the Devices tab under Observed in organization.
36
+
37
+
### Updating 'Protect and manage local admin passwords with Microsoft LAPS' posture recommendation
38
+
39
+
This update aligns the security posture assessment within Secure Score with the latest version of [Windows LAPS](/windows-server/identity/laps/laps-overview), ensuring it reflects current security best practices for managing local administrator passwords.
40
+
41
+
### New and updated events in the Advanced hunting IdentityDirectoryEvents table
42
+
43
+
We have added and updated the following events in the `IdentityDirectoryEvents` table in Advanced Hunting:
44
+
45
+
- User Account control flag has been changed
46
+
47
+
- Security group creation in Active directory
48
+
49
+
- Failed attempt to change an account password
50
+
51
+
- Successful account password change
52
+
53
+
- Account primary group ID has been changed
54
+
55
+
Additionally, the **built-in schema reference** for Advanced Hunting in Microsoft Defender XDR has been updated to include detailed information on all supported event types (**`ActionType`** values) in identity-related tables, ensuring complete visibility into available events. For more information, see [Advanced hunting schema details](/defender-xdr/advanced-hunting-schema-tables).
56
+
25
57
## December 2024
26
58
27
59
### New security posture assessment: Prevent Certificate Enrollment with arbitrary Application Policies (ESC15)
@@ -443,7 +475,7 @@ This version includes the following improvements:
443
475
444
476
For more information, see [Download and schedule Defender for Identity reports in Microsoft Defender XDR (Preview)](reports.md).
445
477
446
-
-**Health issues**: Added the *The 'Remove learning period' toggle was automatically switched off for this tenant* health issue
478
+
-**Health issues**: The 'Remove learning period' toggle was automatically switched off for this tenant* health issue.
447
479
448
480
This version also includes bug fixes for cloud services and the Defender for Identity sensor.
0 commit comments