Local administrators collection (using SAM-R queries) feature is disabled
Analysis / inference: Microsoft Defender for Identity will automatically disable the remote collection of local administrators via SAM-R queries by mid-May 2025.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new archive · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft Defender for Identity is deprecating the remote collection of local administrators group members from endpoints using SAM-R queries, halting updates to lateral movement path maps that depend on this data.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisDisabling remote SAM-R collection for local administrators removes data relied upon for building lateral movement path maps in Microsoft Defender for Identity, impacting internal attack path visibility.
Lateral movement path maps in Microsoft Defender for Identity will no longer be updated after mid-May 2025 until an alternative collection method is introduced.
Section 03 · Recommended actions
- Review current usage of Microsoft Defender for Identity lateral movement path maps.
- Watch for future Microsoft guidance regarding alternative methods for local administrator data collection.
- Verify whether your team relies on Microsoft Defender for Identity lateral movement path maps generated from SAM-R queries.
- Monitor Microsoft Defender for Identity release notes for announcements regarding alternative collection methods.