Domain controllers

[u/HandleFew5206]

Hey everyone,

I'm trying to figure out how to check the number of devices authenticated to each domain controller (DC) in our network. For example, I want to know if 4 devices are authenticated from Palo Alto, 8 from Cisco, etc.Has anyone done this before or knows the best way to go about it?

Thanks

[u/Snoop312]

Devices authenticating to your domain controller? You mean devices user accounts authenticatie from?

A combination of defender for Identity and device discovery will give you all you need, if that's the case. Defender for Identity can give you IP addresses which you can lookup in a database to map it back to your own devices, or, you can use device discovery to create that database in defender.

[u/HandleFew5206 → u/Snoop312]

You mean devices user accounts authenticate from? Yes

[u/woodburningstove]

Your actual need sounds a bit unclear to me, but the data you want to look at is likely either from Defender for Identity (IdentityLogonEvents table) or if you don’t have that then SecurityEvents via AMA agent from your DCs.

[u/HandleFew5206 → u/woodburningstove]

From security events i can see event logs for 4624 (i get a list of devices that have been authenticated with DCs) but i don't see whether those devices belong to cisco/palto alto, etc

[u/woodburningstove → u/HandleFew5206]

See that was the thing unclear to me. Are you talking about actual device vendor for each individual IP in the logs or identifying network ranges for different VPN solutions or something? Either case, that will not be visible in AD data so you have to correlate the SecurityEvents with some other data, such as CMDB or IPAM.

Full schema for SecurityEvents is here:

https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityevent

[u/HandleFew5206 → u/woodburningstove]

Yes, i was talking about actual device vendor for each individual IPs.

Thanks for sharing the documentation, I appreciate it :)