RECENTProduct updateAction required
Automatic RPC auditing on domain controllers
Analysis / inference: Microsoft Defender for Identity sensor version 3.0.8 and later automatically enables RPC auditing on domain controllers without requiring manual tags.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Sensor updates to version 3.0.8 or later remove the requirement for manual tagging by enabling Remote Procedure Call auditing automatically.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisWhy it matters
Automatic configuration changes on domain controllers alter behavioral visibility for security operations without requiring manual sensor tagging.
Operational impact
Reduces administrative overhead for sensor deployment while ensuring consistent RPC auditing coverage across protected domain controllers.
Section 03 · Recommended actions
- Upgrade Defender for Identity sensors to version 3.0.8 or later
- Review domain controller logging configurations to confirm RPC auditing is enabled
What to check
- Verify sensor version 3.0.8 or later is deployed on domain controllers
- Confirm RPC auditing settings are active on domain controllers following sensor upgrade
Affected scope
ProductsDefender for Identity