Forum Discussion

Iron Contributor

Oct 23, 2017

Azure AD Connect - Malicious replication of directory services

Just implemented ATA and the first alert I got was from the MSOL account Azure AD Connect creates from the server it is running on. Is this to be expected?

Thanks

7 Replies

DrewP2400
Copper Contributor
Jul 05, 2019
I too had this same issue and was curious what to do. Thanks for the post
SeyfAllah .
Copper Contributor
Mar 13, 2018
Hello, please exclude the AAD connect server from the detection. Seyfallah Tagrerout Microsoft MVP
- Kazzan
  MVP
  Jun 26, 2019
  Hi, did you manage how to solve that without exclude the alert from such server?
  - Trent
    Iron Contributor
    Jul 01, 2019
    Kazzan no, I had to use an exclude
Nicholas DiCola (SECURITY JEDI)
Former Employee
Oct 24, 2017
are you expecting Azure AD connect to run on that box? if yes, then exlude the machine from that detection.
- Trent
  Iron Contributor
  Oct 27, 2017
  Yes Azure AD Connect is on that machine.
  - Nicholas DiCola (SECURITY JEDI)
    Former Employee
    Oct 27, 2017
    Then exclude it.