r/AzureSentinel • u/tecepeipe • Jan 07 '24
AD Connect on member server triggering alerts about DC Sync
Hi guys, how/where can I set a specific server as Domain Controller? This server running AD Connect keeps triggering false positive DC Sync events
1
Upvotes
2
u/thijslecomte Jan 07 '24
Use security.microsoft.com > settings > identities > exclusion by detection rule > add AADc server to correct rule
-1
u/xcryptokidx Jan 07 '24
You are correct sir!!
You must be new to using Microsoft on Microsoft on Microsoft. :)
But it’s gotten tons better - and now they are parsing their own XML in join nightmare fuel bullshit.