List of events

Occasional Contributor

Hi all 


is somewhere list of event we need to audit on DC, for 100% ATA functionality ?

Like Audit user logon logoff etc....

5 Replies
best response confirmed by Ricky Simpson (Microsoft)

@Or Tsemah the MDI installation says;

  • Under Permissions, select Full Control. All the permissions will be selected, and when triggered, appear as 4662 events. You can then uncheck List and Read permissions, since Defender for Identity only detects changes to directory services.

    Do you need to uncheck ALL the Read and List permissions? it's a lot:)
Yes, as the image suggests
Thanks, just to be clear, you can scroll down and there is a lot of Read permissions, these permissions needs to be be unchecked?