Automatic Windows event auditing configuration for Defender for Identity sensors v3.x
Analysis / inference: Microsoft is rolling out automatic Windows event auditing configuration and health alerts for Defender for Identity sensors version 3.x.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Defender for Identity sensors version 3.x are receiving a gradual rollout of automatic Windows event-auditing configuration and associated health alerts, which applies required auditing settings and flags previous coverage gaps.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisAutomatic configuration of Windows event auditing ensures that Defender for Identity sensors reliably capture necessary security logs without requiring manual domain-wide Group Policy adjustments for each sensor host.
Operations may observe new health alerts identifying previously undetected Windows event auditing configuration gaps on servers hosting v3 sensors.
Section 03 · Recommended actions
- Ensure all servers running v3 sensors have the latest Windows cumulative updates applied
- Verify that automatic Windows event auditing is enabled
- Review Defender for Identity health alerts for newly identified configuration gaps
- Verify that servers running Defender for Identity sensors v3.x are running the latest Windows cumulative update
- Check Defender for Identity health alerts for any newly surfaced auditing configuration gaps
- Confirm automatic Windows event auditing is enabled for sensors v3.x