MC1455016 High
New Defender for Identity health issue for missing Windows events from a domain controller
Summary AI-generated
Microsoft Defender for Identity adds a new sensor health issue to alert admins when sensors are not receiving expected Windows events from domain controllers, improving detection visibility.
Suggested actions AI-generated
- Review affected domain controller if health issue appears
- Check event collection configuration
- Inform security administrators
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1187390 Unified sensor (v3.x) – new Remote Procedure Call (RPC) configuration health alert for Microsoft Defender for Identity
- MC1187386 Microsoft Defender for Identity alerts transitioning to XDR-based detection platform
- MC1187403 (Updated) Automatic Windows event auditing configuration now available for unified sensors (V3.x)
- MC1461705 Microsoft Defender XDR: Unified identity timeline on the Identity page
- MC1193410 (Updated) Automatic Windows event auditing configuration availability for unified sensors (V3.x)
- MC1461704 Microsoft Defender XDR: Unified response actions across identity accounts
Original post from Microsoft
[What and Why:]
Microsoft Defender for Identity is introducing a new sensor health issue, No Windows events received from domain controller, to help administrators identify when Defender for Identity sensors are not receiving expected Windows events from a domain controller.
This new health issue provides better visibility into potential event collection gaps that may affect Microsoft Defender for Identity detections, monitoring, and overall visibility for the affected domain controller.
[Rollout Schedule:]
- Available now.
[Impact on Your Organization:]
Who is affected:
- Organizations using Microsoft Defender for Identity.
Service:
- Microsoft Defender for Identity
After this rollout:
- Administrators may see a new health issue, No Windows events received from domain controller, in the Sensors health issues tab and the global Health issues experience.
- The health issue will be displayed when Defender for Identity is not receiving expected Windows events from a domain controller.
- The notification helps administrators identify and investigate potential event collection gaps that could affect Defender for Identity visibility and detections for the affected domain controller.
[Action Required / Recommendations:]
No action is required before the rollout.
If this health issue appears in your environment after rollout, review the affected domain controller and event collection configuration. If additional assistance is needed, contact Microsoft Support.
You may want to inform your security administrators about this new health monitoring capability.
Additional details from Microsoft
- Summary
- Microsoft Defender for Identity now includes a new sensor health issue, "No Windows events received from domain controller," to alert administrators of missing Windows events. This improves visibility into event collection gaps affecting detections. It is available now, requires no pre-rollout action, and helps identify domain controller issues.