Forum Discussion
defender for identity sensor install
In defender for Identity, do we need to install the agent on every Domain controller? Is this for redundancy? Documentation really does not say
You’ll want to install the Defender for Identity sensor on each DC as it’ll monitor local network connections on those DCs. Failing to do so may result in missing important information for a subset of your AD.
Alternatively you can also set up the standalone sensor, but it would require port mirroring for the standalone server to capture network traffic of the domain controllers.
Alternatively you can also set up the standalone sensor, but it would require port mirroring for the standalone server to capture network traffic of the domain controllers.
Ricky Simpson
Microsoft
MicrosoftYes, we suggest you put the sensor on all domain controllers to ensure you capture the most traffic possible. Be advised that using the standalone sensor described above isn't recommended for an entire environment, as it won't capture Event Tracing for Windows data that the natively installed sensor would capture, and as a result, will impact on several detections.
- Thank you.
