Forum Discussion
Directory Services Advanced Auditing is not enabled
I configured Directory Services Advanced Autiting on a domain (DCs have English OS) in order to support Mdi. I followed the guidance (https://learn.microsoft.com/en-us/defender-for-identity/deploy/configure-windows-event-collection#configure-advanced-audit-policy-settings-from-the-ui).
I did not change the builtin "Default Domain Controllers Policy" but created a new, custom policy object and configured the Advanced Auditing there, assuming it to be best practices.
Now Mdi complains and raised the health issue "Directory Services Advanced Auditing is not enabled". I tried to figure out why it complains and used the mentioned PowerShell modules (Get-MDIConfiguration & Test)-MDIConfiguration and according their output it seems MdI expects GPOs with specific names:
Configuration Mode Status Details
------------- ---- ------ -------
AdvancedAuditPolicyDCs Domain False 'Microsoft Defender for Identity - Advanced Audit Policy for DCs' - GPO not foundSo, is it really not allowed to use custom GP Objects named by our own naming convention? This seems to be silly to me since it'd be possible to query the advanced audit settings in a domain without expecting a specific name of the GPO.
Or are there other ways to figure out why Mdi thinks the Advanced Auditing is not enabled?
Thx!