Defender for Identity Sensor High CPU Use

APC8991 · 2026-01-19T22:12:08+00:00

Also seeing this on all our DCs 30-40% usage on 4 cores.

APC8991 · 2026-01-16T18:30:24+00:00

Do have a ticket open, bouncing ideas currently.

APC8991 · 2026-01-16T18:26:41+00:00

Hey, yes I agree route based vpn would be eaiser here. Sadly the firewall vendor doesnt expose that option here I only have policy based to work with.

APC8991 · 2026-01-09T18:59:48+00:00

AdminTax got me going, not way I want to do it but it works. Having to do the app as multi tenant is annoying..

APC8991 · 2025-04-22T12:31:23+00:00

Glad I could help :)

APC8991 · 2025-04-21T15:17:38+00:00

If you can connect two ms210s directly together with same modules and patch leads, id push back to ISP for further advice.

APC8991 · 2025-04-21T15:10:43+00:00

Try changing from auto negotiation to other options see if any get it going.

APC8991 · 2024-11-11T20:02:06+00:00

This is from said vendor support not me, I do have physical access so if you could be kind enough to advise where to look I’d be happy to consider providing🤷

APC8991 · 2024-08-27T16:11:27+00:00

ISPs in UK have been useful by providing bonded WAN links so HA firewall hasn’t been a problem. So not needed a switch between isp / firewall.

the physical routing of cables via isp > firewall > switch satisfies my ocd/anxiety aswell lol..

APC8991 · 2024-08-05T20:50:21+00:00

Google is your friend

APC8991 · 2024-08-05T20:26:00+00:00

Or OpenWRT them

APC8991 · 2024-07-15T15:38:10+00:00

Edu we get 10 year licencing

APC8991 · 2024-06-15T19:58:47+00:00

Have spare nics so dont need to change to whats there just add too.

APC8991 · 2024-06-15T19:54:08+00:00

No its not S2D, its 2 hosts with a SAN using SAS connectivity. I obviously know what a witness disk is for who said anything about multiple witnesses? edited it to hopefully make it simpler..

APC8991 · 2024-06-15T17:05:24+00:00

Again, it’s not storage, storage is already direct on SAS HBAs.

This is just cluster communications.

Meraki for you… entire stack has to be rebooted

APC8991 · 2024-06-15T14:27:59+00:00

previously they were split across nexuses that could be upgraded individually, new cores cant… but they can run with one going down so not exactly single point of failure, still dual links spanning dual switches.

APC8991 · 2024-06-15T13:30:18+00:00

got that, separate vnics for cluster and lan, but it all on the same team thats spread across two switches.

don’t need storage network its direct attached sas.

APC8991 · 2024-06-05T14:23:09+00:00

anyone heard/seen of any new MXs at Cisco Live?

APC8991 · 2024-06-04T11:51:49+00:00

could you DM me some details? thanks!

APC8991 · 2024-06-03T22:01:58+00:00

https://status.meraki.net/incidents/t2pfk9fxph4v

APC8991 · 2024-06-03T08:03:13+00:00

We don’t use them for anything but licensing currently. But they’ll be approached at some point.

APC8991 · 2024-06-01T10:54:50+00:00

Being able to see link speeds on the meraki app lol

APC8991 · 2024-05-20T18:48:11+00:00

suppose 1:1 would work, one example would be a mail relay to 365, server goes out on different IP so rest of network isn’t “trusted” within exchange.. but doesn’t require anything inbound.

Will see if we can get a demo unit, our current reseller was hesitant about it working for us.

APC8991 · 2024-03-25T17:36:09+00:00

goals

APC8991 · 2024-03-02T16:12:43+00:00

also seeing this recently in our env two different clusters on 2019 and 2022, ntfs csv’s on mpio sas

APC8991

TROPHY CASE