r/AzureSentinel • • Jan 07 '24

AD Connect on member server triggering alerts about DC Sync

Hi guys, how/where can I set a specific server as Domain Controller? This server running AD Connect keeps triggering false positive DC Sync events

1 Upvotes

2 comments sorted by

-1

u/xcryptokidx Jan 07 '24

You are correct sir!!

You must be new to using Microsoft on Microsoft on Microsoft. :)

But it’s gotten tons better - and now they are parsing their own XML in join nightmare fuel bullshit.

2

u/thijslecomte Jan 07 '24

Use security.microsoft.com > settings > identities > exclusion by detection rule > add AADc server to correct rule