Forum Discussion

Iron Contributor

Jan 26, 2021

Solved

Low success rate of active name resolution

New install of Azure ATP Sensor on Domain Controller getting warning "Low success rate of active name resolution". Corp-DC1, failed more than 90% of the time when doing active resolution using Ne...

EliOfek
Jan 26, 2021
RNalivaika
Did you make sure the ports are open as described in

https://docs.microsoft.com/en-us/defender-for-identity/prerequisites#ports

?

If yes, open a support case, so they can increase the trace level on your workspace to tell you more about when it fails.

Icon for Microsoft rank

Microsoft

Jan 26, 2021

RNalivaika
Did you make sure the ports are open as described in

https://docs.microsoft.com/en-us/defender-for-identity/prerequisites#ports

?

If yes, open a support case, so they can increase the trace level on your workspace to tell you more about when it fails.

qwj20201
Copper Contributor
Feb 09, 2021
감사합니다
mesaqee
Copper Contributor
Jan 27, 2021
EliOfek Can you confirm the frequency with which the sensor runs this "name resolution" process?
- EliOfek
  Microsoft
  Jan 27, 2021
  mesaqee
  For every connection opened to the DC, if there wasn't a connection from this endpoint already in the past 30 sec.
  This is current implementation and might change without notice, so do not rely on it in any way.
  - mesaqee
    Copper Contributor
    Feb 03, 2021
    EliOfek Can we the timeout settings for the name resolution( set to 500 ms), if we put up a request with the support team for our tenant? Also, please confirm if 500 ms timeout is the existing configuration from Microsoft side?
RNalivaika
Iron Contributor
Jan 27, 2021
EliOfek you mean Office365 support ?
- EliOfek
  Microsoft
  Jan 27, 2021
  RNalivaika
  
  See here:
  
  https://docs.microsoft.com/en-us/defender-for-identity/support#support-options-and-community-resources
  - RNalivaika
    Iron Contributor
    Feb 15, 2021
    EliOfek MS Support provided me with a sample list of IP adresses failing NNR and we were able to make the necessary changes on the network, so this helped.