Forum Discussion

MeatHeadPro's avatar
MeatHeadPro
Copper Contributor
Jan 20, 2023

Directory Services Advanced Auditing is not enabled

I have received this alert recently and have tried everything to enable auditing per the recommendation found here https://learn.microsoft.com/en-us/defender-for-identity/configure-windows-event-coll...
Martin_Schvartzman's avatar
Martin_Schvartzman
Icon for Microsoft rankMicrosoft
Jan 31, 2023
We're working on fixing this bug. I'll update this thread once I have more information.
MichaelDow's avatar
MichaelDow
Copper Contributor
Mar 07, 2023

Martin_Schvartzmanis this bug also potentially related to the message, Directory Services Object Auditing is not configured as required? We are seeing both of these in our environment despite having configured the policy per the documentation. Thanks!

  • starman2heven's avatar
    starman2heven
    Brass Contributor
    Mar 13, 2023
    Martin_Schvartzman I have a support case open regarding issue like this, OS and Active Directory in German. MS support have been bouncing my around departments for 6 days, I'm still waiting for someone who knows anything about MDI. I have tried to run your script test-MDIReadiness, but it fails with an error:

    Compare-Object : Cannot bind argument to parameter 'DifferenceObject' because it is null.
    At C:\Temp\Test-MdiReadiness.ps1:417 char:55
    + $isAdvancedAuditingOk = $null -eq (Compare-Object @compareParams)
    + ~~~~~~~~~~~~~~
    + CategoryInfo : InvalidData: (:) [Compare-Object], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.CompareObjectCommand
    • Martin_Schvartzman's avatar
      Martin_Schvartzman
      Icon for Microsoft rankMicrosoft
      Mar 22, 2023

      starman2heven MichaelDow MeatHeadPro 

      We found a couple of bugs in the detection logic for this health alert.

      One (as mentioned above) for non-English operating systems, and another for domain schemas earlier than 87.

      These are fixed as part of v2.201 that should be rolled out starting next week.

      • Martin_Schvartzman's avatar
        Martin_Schvartzman
        Icon for Microsoft rankMicrosoft
        Mar 28, 2023

        MeatHeadPro 

        I apologize, the fix (non-English operating systems, and schemas earlier than 87) in v2.201 is for the Directory Services Object Auditing health alert, and not for the Directory Services Advanced Auditing health alert as you initially reported.

        Could you please open a support ticket and share more details on the problem you are facing?

         

        starman2heven MichaelDow FYI