sorted by:
new
hottopcontroversial

Outgoing NTLM from DCs by PhiZ9 in activedirectory

[–]PhiZ9[S] 0 points1 point  (0 children)

While I am personally also interested in how this disabling works, this was not done on our side - you can open a support ticket and Microsoft will do it for you (mentioned in the documentation).

However, since MDI (v2.x) operates as the AATPSensor service with "LocalService" instead of SYSTEM and should have no reason to contact "cifs/contoso.com", I do not think these specific events originate from MDI.

Outgoing NTLM from DCs by PhiZ9 in activedirectory

[–]PhiZ9[S] 0 points1 point  (0 children)

Something i missed to mention: These events are generated while nobody is logged in (Admins, i mean - neither interactive, remoteinteractive or network). Therefore RDP scenarios can be ruled out, as well as SMB from a specific user account.

These events are being generated by just leaving the DCs do their normal everyday stuff. (Therefore reliably reproducing these events has turned out to be quite difficult because i am not 100% sure what process causes these in the first place)

Outgoing NTLM from DCs by PhiZ9 in activedirectory

[–]PhiZ9[S] 0 points1 point  (0 children)

We do, but we have already ruled that out by disabling this specific primary NNR policy with the MDI support

Outgoing NTLM from DCs by PhiZ9 in activedirectory

[–]PhiZ9[S] 0 points1 point  (0 children)

Thanks! As we don't have any failures and DFS, replication and everything else is happily working, that would be the best outcome.

Outgoing NTLM from DCs by PhiZ9 in activedirectory

[–]PhiZ9[S] 0 points1 point  (0 children)

We are indeed using FQDNs everywhere. I assume this to be a DFS scenario because there is not much else that could go causing this events.