Forum Discussion
Jeroen_van_der_Broek
Oct 28, 2022Copper Contributor
The new local admin lock is great but locks not detected (shown) by Defender.
The new local admin lock (https://support.microsoft.com/en-us/topic/kb5020282-account-lockout-available-for-built-in-local-administrators-bce45c4d-f28d-43ad-b6fe-70156cb2dc00) is great but locks not detected (shown) by Defender Endpoint. I tried the new function and after it locks it generates an event ID 4740. But i noticed this is not being picked up although the server is onboarded.
We do not have all the systems connected to OMS and this is also not going to happen soon. For now we will pick the event up with SCOM. But would be nice that this alert shows up in the endpoint for defender portal.
No RepliesBe the first to reply