Forum Discussion
No updates to "Stop clear text credentials exposure" after migrating our MDI sensors to v3
Microsoft Support has confirmed this is a "known issue" with the v3 sensor. I have asked whether there are any other recommendations or alerts that are impacted but have not yet received a response. I'll try to remember to update this post if I do.
The recommendation’s “Last seen” date stopping when the domain controllers moved to sensor v3 is useful correlation, but IdentityQueryEvents rows only confirm that identity-query telemetry is arriving; ordinary LDAP searches do not prove clear-text credential exposure. Check Settings > Identities > On-premises > Sensors and confirm each migrated controller shows Up to date, Running, and healthy. Verify each server is onboarded to Defender for Endpoint, meets the supported Windows Server and cumulative-update prerequisites, and has no sensor alerts. In Advanced Hunting, inspect the affected period by controller, protocol, port, action type, and AdditionalFields, then compare it with an entity still listed by the recommendation. Allow a complete daily assessment cycle after generating a controlled test event. If telemetry is healthy but “Last seen” remains frozen, collect sensor health details, timestamps, and hunting results and open a Microsoft support case. Microsoft documents no administrator command to force-refresh this recommendation.