Forum Discussion

MeatHeadPro's avatar
MeatHeadPro
Copper Contributor
Jan 20, 2023

Directory Services Advanced Auditing is not enabled

I have received this alert recently and have tried everything to enable auditing per the recommendation found here https://learn.microsoft.com/en-us/defender-for-identity/configure-windows-event-coll...
Martin_Schvartzman's avatar
Martin_Schvartzman
Icon for Microsoft rankMicrosoft
Jan 31, 2023
We're working on fixing this bug. I'll update this thread once I have more information.
  • MichaelDow's avatar
    MichaelDow
    Copper Contributor
    Mar 07, 2023

    Martin_Schvartzmanis this bug also potentially related to the message, Directory Services Object Auditing is not configured as required? We are seeing both of these in our environment despite having configured the policy per the documentation. Thanks!

    • starman2heven's avatar
      starman2heven
      Brass Contributor
      Mar 13, 2023
      Martin_Schvartzman I have a support case open regarding issue like this, OS and Active Directory in German. MS support have been bouncing my around departments for 6 days, I'm still waiting for someone who knows anything about MDI. I have tried to run your script test-MDIReadiness, but it fails with an error:

      Compare-Object : Cannot bind argument to parameter 'DifferenceObject' because it is null.
      At C:\Temp\Test-MdiReadiness.ps1:417 char:55
      + $isAdvancedAuditingOk = $null -eq (Compare-Object @compareParams)
      + ~~~~~~~~~~~~~~
      + CategoryInfo : InvalidData: (:) [Compare-Object], ParameterBindingValidationException
      + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.CompareObjectCommand

Resources