Microsoft Defender for Identity
Identity protectionHealth Alerts
In brief
The guidance now specifies that automatic Windows event auditing applies to v3.x sensors and tells administrators to check the health issue table for the relevant sensor version before remediation. Several alert descriptions were also clarified.
What Defender admins need to know
Use the sensor-version guidance when investigating health alerts and selecting remediation steps; no immediate configuration change is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
The Microsoft Defender for Identity Health Issues page lists issues affecting your Defender for Identity deployment and sensors. It alerts you to detected problems that might result from configuration or environmental factors.
ConfigureFor v3.x sensors, configure automatic Windows event auditing to help prevent issues related to Windows event collection. Before following a remediation procedure, check the health issue table for the applicable sensor version.
Health issues page
| Sensor reached a memory resource limit | The Defender for Identity sensor stopped itself and restarts automatically to protect the domain controller from a low memory condition. The Defender for Identity sensor enforces memory limitations upon itself to prevent the domain controller from experiencing resource limitations. This issue occurs when memory usage on the domain controller is high. Data from this domain controller is only partly monitored. | Increase the amount of memory (RAM) on the domain controller or add more domain controllers in this site to better distribute the load of this domain controller. | Medium | Sensors health issues tab | 2.x |
| Sensor service failed to start | The Defender for Identity sensor service failed to start for at least 30 minutes. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Monitor Defender for Identity sensor logs to understand the root cause for Defender for Identity sensor service failure. | High | Sensors health issues tab | All |
| Sensor stopped communicating | There has been no communication from the Defender for Identity sensor. The default time span for this alert is 5 minutes. This issue indicates that the sensor failed to send data or a keep-alive signal to the Defender for Identity services for a period exceeding the allowed time. This issue typically suggests either a network issue in the environment that prevented data transmission or a server restart that took longer than the acceptable time frame, impacting Defender for Identity's ability to detect suspicious activities. | Check that the communication between the Defender for Identity sensor and Defender for Identity cloud service isn't blocked by any routers or firewalls. | Medium | Sensors health issues tab | All |
| Some Windows events are not being analyzed | The Defender for Identity sensor is receivingreceives more Windows events than it can process which causesprocess, so some Windows events aren't being analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider adding more processors and memory as required. If you're using a standalone Defender for Identity sensor, verify that only the required events are forwarded to the sensor. Or, try forwarding some events to another Defender for Identity sensor. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
| Some network traffic could not be analyzed | The Defender for Identity sensor is receivingreceives more network traffic than it can process which causesprocess, so some network traffic couldnisn't be analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider adding more processors and memory as required. If you're using a standalone Defender for Identity sensor, reduce the number of domain controllers being monitored.This issue can also happen if you're using domain controllers on VMware virtual machines. To avoid these issues, you can check that the following settings are set to 0 or Disabled in the virtual machine (in the Windows OS, not in the VMware settings):- Large Send Offload V2 (IPv4)- IPv4 TSO OffloadThe names can vary depending on your VMware version. For more information, see your VMware documentation. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
| Some ETW events are not being analyzed | The Defender for Identity sensor is receivingreceives more Event Tracing for Windows (ETW) events than it can process which causesprocess, so some Event Tracing for Windows (ETW)ETW events aren't being analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider adding more processors and memory as required. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
| Sensor running on an operating system that will soon become unsupported | The Defender for Identity sensor is running on an operating system that will soon become unsupported. Windows Server 2012 and 2012 R2 reached end of support on October 10, 2023. More details can be found at: https://aka.ms/mdi/oseos | The operating system on the server should be upgraded to the latest supported operating system. For more information, see Minimum operating system requirements. | Medium | Sensors health issues tab | 2.x |
| Sensor running on an unsupported operating system | The Defender for Identity sensor is running on an unsupported operating system. Windows Server 2012 and 2012 R2 reached end of support on October 10, 2023. More details can be found at: https://aka.ms/mdi/oseos | The operating system on the server should be upgraded to the latest supported operating system. For more information, see Minimum operating system requirements. | High | Sensors health issues tab | All |
| Sensor has issues with packet capturing component | The Defender for Identity sensor is using WinPcap drivers instead of Npcap drivers. All customers should be using Npcap drivers instead of the WinPcap drivers. Starting with Defender for Identity version 2.184, the installation package installs Npcap 1.0 OEM. | Install Npcap according to the guidance as described in: https://aka.ms/mdi/npcap | High | Sensors health issues tab | 2.x |
| Directory Services Advanced Auditing is not enabled as required | The Directory Services Advanced Auditing configuration doesn't include all the categories and subcategories as required. (This configuration is validated once a day, per sensor.) | Enable the Directory Services Advanced Auditing events. For more information, see Configure audit policies for Windows event logs. | Medium | Sensors health issues tab | All |
| Directory Services Object Auditing is not enabled as required | The Directory Services Object Auditing configuration doesn't include all the object types and permissions as required. (This configuration is validated once a day, per domain.) | Enable the Directory Services Object Auditing events according to the guidance as described in the Configure domain object auditing section, in the Configure Windows Event collection page. | Medium | Global health issues tab | All |
| Auditing on the Configuration container is not enabled as required | The Directory Services Auditing on the Domain's Configuration container isn't enabled as required. (This configuration is validated once a day, per domain.) Active Directory replicates the configuration container throughout the forest, so configure auditing once for the entire forest. The health alert might appear for multiple domains because sensors in each domain report the state of the shared configuration container. | Enable the Directory Services Auditing on the Domain's Configuration container according to the guidance as described in the Configure Audit Policies section, in the Configure Windows Event collection page. | Medium | Global health issues tab | All |
| Auditing on the ADFS container is not enabled as required | The Directory Services Auditing on the ADFS container isn't enabled as required. (This configuration is validated once a day, per domain.) | Enable the Directory Services Auditing on the ADFS container according to the guidance as described in the Configure auditing on an Active Directory Federation Services (AD FS)Configure auditing on an Active Directory Federation Services (AD FS) section, in the Configure Windows Event collection page. | Medium | Global health issues tab | All |
| Power mode isn't configured for optimal processor performance | The operating system's power mode isn't configured to the optimal processor performance settings. (This configuration is validated once a day, per sensor.) This issue can affect the server's performance and the sensors' ability to detect suspicious activities. | Do one of the following: - Configure the power option of the machine running the Defender for Identity sensor to High Performance- Set both the minimum and maximum processor state to 100For more information, see the Server requirements section in the Defender for Identity prerequisites page. | Low | Sensors health issues tab | 2.x |
| Sensor failed to write to the custom log path | The custom log path provided in the sensor configuration can't be created. | 1. Stop the AATPSensorUpdater and AATPSensor services. 2. Change the SensorCustomLogLocation in the sensor configuration file to a valid path or set it to null. 3. Start the AATPSensorUpdater and AATPSensor services again. | Low | Sensors health issues tab | 2.x |
| Radius accounting (VPN integration) data ingestion failures | The listed Defender for Identity sensors have radius accounting (VPN integration) data ingestion failures. | Validate that the shared secret in the Defender for Identity configuration settings matches your VPN server, according to the guidance described Configure VPN in Defender for Identity section, in the Defender for Identity VPN integration page. | Low | Health issues page | 2.x |
| Auditing for AD CS servers isn't enabled as required | The Advanced Auditing Policy Configuration or AD CS auditing isn't enabled as required. (This configuration is validated once a day, per sensor.) | Enable the Advanced Auditing Policy Configuration and AD CS auditing according to the guidance as described in the Configure auditing on AD CSConfigure auditing on AD CS section, in the Configure Windows Event collection page. | Medium | Sensors health issues tab | 2.x |
| Sensor failed to retrieve Microsoft Entra Connect service configuration | The sensor is unable to retrieve the configuration from the Microsoft Entra Connect service (also known as Microsoft Azure AD sync). | Ensure that the Microsoft Entra connect service (Microsoft Azure AD Sync) is running and follow the instructions in Configure permissions for the Microsoft Entra Connect (ADSync) database to grant the sensor the necessary permissions. If the issue persists, follow the troubleshooting guidance at SQL connectivity issues with Microsoft Entra Connect. | Medium | Sensors health issues tab | 2.x |
| Sensor v3.x RPC Audit Misconfigured | The sensor is missing the required Unified Sensor RPC Audit configuration tag, or the tag was not applied correctly. | To resolve this issue, do one of the following:- Verify that the Unified Sensor RPC Audit configuration is correctly applied to the relevant devices. Once the tag is applied, the configuration is enforced automatically on matching devices.- Install the September 2026 or later Windows cumulative update to upgrade the Defender for Identity sensor to version 3.0.10 or later. In sensor version 3.0.8 or later, RPC auditing is applied automatically, and the tag is no longer required.For more information, see Configure RPC auditing. | Medium | Sensors health issues tab | 3.x |
@@ -13,7 +13,7 @@ ms.service: microsoft-defender-for-identity uhfHeaderId: MSDocsHeader-MicrosoftDefender ms.suite: ems description: Learn about health issues in Microsoft Defender for Identity, including causes and resolution steps for sensor and domain-related alerts.-ms.date: 2026-09-06T00:00:00.0000000Z+ms.date: 2026-10-18T00:00:00.0000000Z ms.topic: how-to ms.reviewer: rlitinsky ai-usage: ai-assisted@@ -50,7 +50,7 @@ platformId: 002e00a7-0e1d-673c-d854-8ddd420d02f6 The Microsoft Defender for Identity Health Issues page lists issues affecting your Defender for Identity deployment and sensors. It alerts you to detected problems that might result from configuration or environmental factors.
-Configure [automatic Windows event auditing](deploy/configure-windows-event-collection) to help prevent issues related to Windows event collection.
+For v3.x sensors, configure [automatic Windows event auditing](deploy/configure-windows-event-collection) to help prevent issues related to Windows event collection. Before following a remediation procedure, check the health issue table for the applicable sensor version.
## Health issues page
@@ -108,9 +108,9 @@ Each health issue table includes a **Displayed in** column that indicates whethe | **Sensor reached a memory resource limit** | The Defender for Identity sensor stopped itself and restarts automatically to protect the domain controller from a low memory condition. The Defender for Identity sensor enforces memory limitations upon itself to prevent the domain controller from experiencing resource limitations. This issue occurs when memory usage on the domain controller is high. Data from this domain controller is only partly monitored. | Increase the amount of memory (RAM) on the domain controller or add more domain controllers in this site to better distribute the load of this domain controller. | Medium | Sensors health issues tab | 2.x |
| **Sensor service failed to start** | The Defender for Identity sensor service failed to start for at least 30 minutes. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Monitor Defender for Identity sensor logs to understand the root cause for Defender for Identity sensor service failure. | High | Sensors health issues tab | All |
| **Sensor stopped communicating** | There has been no communication from the Defender for Identity sensor. The default time span for this alert is 5 minutes. This issue indicates that the sensor failed to send data or a keep-alive signal to the Defender for Identity services for a period exceeding the allowed time. This issue typically suggests either a network issue in the environment that prevented data transmission or a server restart that took longer than the acceptable time frame, impacting Defender for Identity's ability to detect suspicious activities. | Check that the communication between the Defender for Identity sensor and Defender for Identity cloud service isn't blocked by any routers or firewalls. | Medium | Sensors health issues tab | All |
-| **Some Windows events are not being analyzed** | The Defender for Identity sensor is receiving more events than it can process which causes some Windows events aren't being analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider [adding more processors and memory](capacity-planning) as required. If you're using a standalone Defender for Identity sensor, verify that only the required events are forwarded to the sensor. Or, try forwarding some events to another Defender for Identity sensor. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
-| **Some network traffic could not be analyzed** | The Defender for Identity sensor is receiving more network traffic than it can process which causes some network traffic couldn't be analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider [adding more processors and memory](capacity-planning) as required. If you're using a standalone Defender for Identity sensor, reduce the number of domain controllers being monitored.This issue can also happen if you're using domain controllers on VMware virtual machines. To avoid these issues, you can check that the following settings are set to **0** or **Disabled** in the virtual machine (in the Windows OS, not in the VMware settings):- **Large Send Offload V2 (IPv4)**- **IPv4 TSO Offload**The names can vary depending on your VMware version. For more information, see your VMware documentation. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
-| **Some ETW events are not being analyzed** | The Defender for Identity sensor is receiving more Event Tracing for Windows (ETW) events than it can process which causes some Event Tracing for Windows (ETW) events aren't being analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider [adding more processors and memory](capacity-planning) as required. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
+| **Some Windows events are not being analyzed** | The Defender for Identity sensor receives more Windows events than it can process, so some events aren't analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider [adding more processors and memory](capacity-planning) as required. If you're using a standalone Defender for Identity sensor, verify that only the required events are forwarded to the sensor. Or, try forwarding some events to another Defender for Identity sensor. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
+| **Some network traffic could not be analyzed** | The Defender for Identity sensor receives more network traffic than it can process, so some traffic isn't analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider [adding more processors and memory](capacity-planning) as required. If you're using a standalone Defender for Identity sensor, reduce the number of domain controllers being monitored.This issue can also happen if you're using domain controllers on VMware virtual machines. To avoid these issues, you can check that the following settings are set to **0** or **Disabled** in the virtual machine (in the Windows OS, not in the VMware settings):- **Large Send Offload V2 (IPv4)**- **IPv4 TSO Offload**The names can vary depending on your VMware version. For more information, see your VMware documentation. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
+| **Some ETW events are not being analyzed** | The Defender for Identity sensor receives more Event Tracing for Windows (ETW) events than it can process, so some ETW events aren't analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider [adding more processors and memory](capacity-planning) as required. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
| **Sensor running on an operating system that will soon become unsupported** | The Defender for Identity sensor is running on an operating system that will soon become unsupported. Windows Server 2012 and 2012 R2 reached end of support on October 10, 2023. More details can be found at: https://aka.ms/mdi/oseos | The operating system on the server should be upgraded to the latest supported operating system. For more information, see [Minimum operating system requirements](deploy/prerequisites-sensor-version-2#minimum-operating-system-requirements). | Medium | Sensors health issues tab | 2.x |
| **Sensor running on an unsupported operating system** | The Defender for Identity sensor is running on an unsupported operating system. Windows Server 2012 and 2012 R2 reached end of support on October 10, 2023. More details can be found at: https://aka.ms/mdi/oseos | The operating system on the server should be upgraded to the latest supported operating system. For more information, see [Minimum operating system requirements](deploy/prerequisites-sensor-version-2#minimum-operating-system-requirements). | High | Sensors health issues tab | All |
| **Sensor has issues with packet capturing component** | The Defender for Identity sensor is using WinPcap drivers instead of Npcap drivers. All customers should be using Npcap drivers instead of the WinPcap drivers. Starting with Defender for Identity version 2.184, the installation package installs Npcap 1.0 OEM. | Install Npcap according to the guidance as described in: https://aka.ms/mdi/npcap | High | Sensors health issues tab | 2.x |
@@ -120,11 +120,11 @@ Each health issue table includes a **Displayed in** column that indicates whethe | **Directory Services Advanced Auditing is not enabled as required** | The Directory Services Advanced Auditing configuration doesn't include all the categories and subcategories as required. (This configuration is validated once a day, per sensor.) | Enable the Directory Services Advanced Auditing events. For more information, see [Configure audit policies for Windows event logs](configure-windows-event-collection). | Medium | Sensors health issues tab | All |
| **Directory Services Object Auditing is not enabled as required** | The Directory Services Object Auditing configuration doesn't include all the object types and permissions as required. (This configuration is validated once a day, per domain.) | Enable the Directory Services Object Auditing events according to the guidance as described in the [Configure domain object auditing](configure-windows-event-collection#configure-domain-object-auditing) section, in the [Configure Windows Event collection](configure-windows-event-collection) page. | Medium | Global health issues tab | All |
| **Auditing on the Configuration container is not enabled as required** | The Directory Services Auditing on the Domain's Configuration container isn't enabled as required. (This configuration is validated once a day, per domain.) Active Directory replicates the configuration container throughout the forest, so configure auditing once for the entire forest. The health alert might appear for multiple domains because sensors in each domain report the state of the shared configuration container. | Enable the Directory Services Auditing on the Domain's Configuration container according to the guidance as described in the [Configure Audit Policies](configure-windows-event-collection#enable-auditing-on-an-exchange-object) section, in the [Configure Windows Event collection](configure-windows-event-collection) page. | Medium | Global health issues tab | All |
-| **Auditing on the ADFS container is not enabled as required** | The Directory Services Auditing on the ADFS container isn't enabled as required. (This configuration is validated once a day, per domain.) | Enable the Directory Services Auditing on the ADFS container according to the guidance as described in the [Configure auditing on an Active Directory Federation Services (AD FS)](configure-windows-event-collection#configure-auditing-on-an-active-directory-federation-services-ad-fs) section, in the [Configure Windows Event collection](configure-windows-event-collection) page. | Medium | Global health issues tab | All |
+| **Auditing on the ADFS container is not enabled as required** | The Directory Services Auditing on the ADFS container isn't enabled as required. (This configuration is validated once a day, per domain.) | Enable the Directory Services Auditing on the ADFS container according to the guidance as described in the [Configure auditing on an Active Directory Federation Services (AD FS)](deploy/configure-windows-event-collection#configure-auditing-on-an-ad-fs-server) section, in the [Configure Windows Event collection](configure-windows-event-collection) page. | Medium | Global health issues tab | All |
| **Power mode isn't configured for optimal processor performance** | The operating system's power mode isn't configured to the optimal processor performance settings. (This configuration is validated once a day, per sensor.) This issue can affect the server's performance and the sensors' ability to detect suspicious activities. | Do one of the following: - Configure the power option of the machine running the Defender for Identity sensor to *High Performance*- Set both the minimum and maximum processor state to *100*For more information, see the [Server requirements](deploy/prerequisites-sensor-version-2#server-requirements) section in the [Defender for Identity prerequisites](deploy/prerequisites-sensor-version-2) page. | Low | Sensors health issues tab | 2.x |
| **Sensor failed to write to the custom log path** | The custom log path provided in the sensor configuration can't be created. | 1. Stop the `AATPSensorUpdater` and `AATPSensor` services. 2. Change the `SensorCustomLogLocation` in the sensor configuration file to a valid path or set it to null. 3. Start the `AATPSensorUpdater` and `AATPSensor` services again. | Low | Sensors health issues tab | 2.x |
| **Radius accounting (VPN integration) data ingestion failures** | The listed Defender for Identity sensors have radius accounting (VPN integration) data ingestion failures. | Validate that the shared secret in the Defender for Identity configuration settings matches your VPN server, according to the guidance described [Configure VPN in Defender for Identity](vpn-integration#configure-vpn-in-defender-for-identity) section, in the [Defender for Identity VPN integration](vpn-integration) page. | Low | Health issues page | 2.x |
-| **Auditing for AD CS servers isn't enabled as required** | The Advanced Auditing Policy Configuration or AD CS auditing isn't enabled as required. (This configuration is validated once a day, per sensor.) | Enable the Advanced Auditing Policy Configuration and AD CS auditing according to the guidance as described in the [Configure auditing on AD CS](configure-windows-event-collection#configure-auditing-on-ad-cs) section, in the [Configure Windows Event collection](configure-windows-event-collection) page. | Medium | Sensors health issues tab | 2.x |
+| **Auditing for AD CS servers isn't enabled as required** | The Advanced Auditing Policy Configuration or AD CS auditing isn't enabled as required. (This configuration is validated once a day, per sensor.) | Enable the Advanced Auditing Policy Configuration and AD CS auditing according to the guidance as described in the [Configure auditing on AD CS](deploy/configure-windows-event-collection#configure-auditing-on-an-ad-cs-server) section, in the [Configure Windows Event collection](configure-windows-event-collection) page. | Medium | Sensors health issues tab | 2.x |
| **Sensor failed to retrieve Microsoft Entra Connect service configuration** | The sensor is unable to retrieve the configuration from the Microsoft Entra Connect service (also known as Microsoft Azure AD sync). | Ensure that the Microsoft Entra connect service **(Microsoft Azure AD Sync)** is running and follow the instructions in [Configure permissions for the Microsoft Entra Connect (ADSync) database](deploy/active-directory-federation-services#configure-permissions-for-the-microsoft-entra-connect-adsync-database) to grant the sensor the necessary permissions. If the issue persists, follow the troubleshooting guidance at [SQL connectivity issues with Microsoft Entra Connect](/en-us/entra/identity/hybrid/connect/tshoot-connect-tshoot-sql-connectivity). | Medium | Sensors health issues tab | 2.x |
| **Sensor v3.x RPC Audit Misconfigured** | The sensor is missing the required Unified Sensor RPC Audit configuration tag, or the tag was not applied correctly. | To resolve this issue, do one of the following:- Verify that the Unified Sensor RPC Audit configuration is correctly applied to the relevant devices. Once the tag is applied, the configuration is enforced automatically on matching devices.- Install the September 2026 or later Windows cumulative update to upgrade the Defender for Identity sensor to version 3.0.10 or later. In sensor version 3.0.8 or later, RPC auditing is applied automatically, and the tag is no longer required.For more information, see [Configure RPC auditing](deploy/deploy-sensor-v3#configure-rpc-auditing). | Medium | Sensors health issues tab | 3.x |