Forum Discussion

DrewP2400's avatar
DrewP2400
Copper Contributor
Jul 05, 2019

Reconnaissance using account enumeration - how to troubleshoot

Hello, I have a new install of ATA on 6 DC's.  2 DC's are in Azure space for our AD Connect sync/ADFS.  Is this alert a common occurance seen on ADFS/WAP servers? safe to create an exception?   Sh...
Joel Jerkin's avatar
Joel Jerkin
Copper Contributor
Jul 07, 2019

Azure AD Connect servers are typically causing false positive-alerts and could be excluded under "Suspected DCSync attack (replication of directory services)":

 

  • DrewP2400's avatar
    DrewP2400
    Copper Contributor
    Jul 07, 2019

    Joel Jerkin 

    Thanks for the reply, however, in this case AD Connect or replication of DS is not involved in this scenario.

Resources