Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 272/272 feeds/APIs · 469/469 docs · 8/9 advisories · checked 07:24 UTC Customize Public modeDiscuss ChangeIntel on Discord

New Defender for Identity health issue for missing Windows events from a domain controller

Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.

Rollout

Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".

What the notice says

Microsoft’s text, with source markup removed
What and Why: Microsoft Defender for Identity is introducing a new sensor health issue, No Windows events received from domain controller, to help administrators identify when Defender for Identity sensors are not receiving expected Windows events from a domain controller. This new health issue provides better visibility into potential event collection gaps that may affect Microsoft Defender for Identity detections, monitoring, and overall visibility for the affected domain controller. Rollout Schedule: Available now. Impact on Your Organization: Who is affected: Organizations using Microsoft Defender for Identity. Service: Microsoft Defender for Identity After this rollout: Administrators may see a new health issue, No Windows events received from domain controller, in the Sensors health issues tab and the global Health issues experience. The health issue will be displayed when Defender for Identity is not receiving expected Windows events from a domain controller. The notification helps administrators identify and investigate potential event collection gaps that could affect Defender for Identity visibility and detections for the affected domain controller. Action Required / Recommendations: No action is required before the rollout. If this health issue appears in your environment after rollout, review the affected domain controller and event collection configuration. If additional assistance is needed, contact Microsoft Support. You may want to inform your security administrators about this new health monitoring capability.

What changed

Between archive captures, newest first

The archive supplies one version of this notice.

Linked documentation

Microsoft pages the notice links to

The notice links to no Microsoft Learn or Support page that this installation reads.

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 26 Oct 07:24 UTC · 272 of 272 readable · 270 fully read · documentation 469/469 current