Microsoft Defender for Identity
Identity protectionHealth Alerts
In brief
The health-alert documentation now identifies Windows Server 2016 as approaching extended end of support and links to Legacy operating systems guidance. Windows Server 2012 and 2012 R2 remain identified as unsupported.
What Defender admins need to know
Administrators can use the linked guidance to assess sensors running on operating systems nearing or past support.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Some Windows events are not being analyzed | The Defender for Identity sensor receives more Windows events than it can process, so some events aren't analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider adding more processors and memory as required. If you're using a standalone Defender for Identity sensor, verify that only the required events are forwarded to the sensor. Or, try forwarding some events to another Defender for Identity sensor. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
| Some network traffic could not be analyzed | The Defender for Identity sensor receives more network traffic than it can process, so some traffic isn't analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider adding more processors and memory as required. If you're using a standalone Defender for Identity sensor, reduce the number of domain controllers being monitored.This issue can also happen if you're using domain controllers on VMware virtual machines. To avoid these issues, you can check that the following settings are set to 0 or Disabled in the virtual machine (in the Windows OS, not in the VMware settings):- Large Send Offload V2 (IPv4)- IPv4 TSO OffloadThe names can vary depending on your VMware version. For more information, see your VMware documentation. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
| Some ETW events are not being analyzed | The Defender for Identity sensor receives more Event Tracing for Windows (ETW) events than it can process, so some ETW events aren't analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider adding more processors and memory as required. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
| Sensor running on an operating system that will soon become unsupported | The Defender for Identity sensor is running on an operating system that will soon become unsupported. Windows Server 2012 and 2012 R2 reached2016 is approaching extended end of support on October 10, 2023. More details can be found at:support. For more information, see Legacy operating systems and https://aka.ms/mdi/oseos. | The operating system on the server should be upgraded to the latest supported operating system. For more information, see Minimum operating system requirements. | Medium | Sensors health issues tab | 2.x |
| Sensor running on an unsupported operating system | The Defender for Identity sensor is running on an unsupported operating system. Windows Server 2012 and 2012 R2 reached end of support on October 10, 2023. For Windows Server 2016 lifecycle guidance, see Legacy operating systems. More details can be found at: https://aka.ms/mdi/oseos | The operating system on the server should be upgraded to the latest supported operating system. For more information, see Minimum operating system requirements. | High | Sensors health issues tab | All |
| Sensor has issues with packet capturing component | The Defender for Identity sensor is using WinPcap drivers instead of Npcap drivers. All customers should be using Npcap drivers instead of the WinPcap drivers. Starting with Defender for Identity version 2.184, the installation package installs Npcap 1.0 OEM. | Install Npcap according to the guidance as described in: https://aka.ms/mdi/npcap | High | Sensors health issues tab | 2.x |
| Sensor has issues with packet capturing component | The Defender for Identity sensor is running an Npcap version older than the minimum required version. The minimum Npcap version supported is 1.0. Starting with Defender for Identity version 2.184, the installation package installs Npcap 1.0 OEM. | Upgrade Npcap according to the guidance as described in: https://aka.ms/mdi/npcap | Medium | Sensors health issues tab | 2.x |
| Sensor has issues with packet capturing component | The Defender for Identity sensor is running an Npcap component that isn't configured as required. The Npcap installation is missing the required configuration options. | Install Npcap according to the guidance as described in: https://aka.ms/mdi/npcap | High | Sensors health issues tab | 2.x |
@@ -37,12 +37,8 @@ item_type: Content source_path: defender-for-identity/health-alerts.md cmProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/5711eaa5-435f-4c40-8d89-924ef7945eec-- https://authoring-docs-microsoft.poolparty.biz/devrel/bcbcbad5-4208-4783-8035-8481272c98b8-- https://authoring-docs-microsoft.poolparty.biz/devrel/07bb3e10-d135-43ff-bc8b-360497cb39fa spProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/8ee4d551-d6c4-4e91-986e-0f1afd52559f-- https://authoring-docs-microsoft.poolparty.biz/devrel/43b2e5aa-8a6d-4de2-a252-692232e5edc8-- https://authoring-docs-microsoft.poolparty.biz/devrel/12e559b9-eaf6-4aee-9af7-62334e15f863 platformId: 002e00a7-0e1d-673c-d854-8ddd420d02f6 --- @@ -111,8 +107,8 @@ Each health issue table includes a **Displayed in** column that indicates whethe | **Some Windows events are not being analyzed** | The Defender for Identity sensor receives more Windows events than it can process, so some events aren't analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider [adding more processors and memory](capacity-planning) as required. If you're using a standalone Defender for Identity sensor, verify that only the required events are forwarded to the sensor. Or, try forwarding some events to another Defender for Identity sensor. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
| **Some network traffic could not be analyzed** | The Defender for Identity sensor receives more network traffic than it can process, so some traffic isn't analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider [adding more processors and memory](capacity-planning) as required. If you're using a standalone Defender for Identity sensor, reduce the number of domain controllers being monitored.This issue can also happen if you're using domain controllers on VMware virtual machines. To avoid these issues, you can check that the following settings are set to **0** or **Disabled** in the virtual machine (in the Windows OS, not in the VMware settings):- **Large Send Offload V2 (IPv4)**- **IPv4 TSO Offload**The names can vary depending on your VMware version. For more information, see your VMware documentation. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
| **Some ETW events are not being analyzed** | The Defender for Identity sensor receives more Event Tracing for Windows (ETW) events than it can process, so some ETW events aren't analyzed. This issue can affect the ability to detect suspicious activities originating from domain controllers monitored by this Defender for Identity sensor. | Consider [adding more processors and memory](capacity-planning) as required. | Medium | Sensors health issues tab and Global health issues tab | 2.x |
-| **Sensor running on an operating system that will soon become unsupported** | The Defender for Identity sensor is running on an operating system that will soon become unsupported. Windows Server 2012 and 2012 R2 reached end of support on October 10, 2023. More details can be found at: https://aka.ms/mdi/oseos | The operating system on the server should be upgraded to the latest supported operating system. For more information, see [Minimum operating system requirements](deploy/prerequisites-sensor-version-2#minimum-operating-system-requirements). | Medium | Sensors health issues tab | 2.x |
-| **Sensor running on an unsupported operating system** | The Defender for Identity sensor is running on an unsupported operating system. Windows Server 2012 and 2012 R2 reached end of support on October 10, 2023. More details can be found at: https://aka.ms/mdi/oseos | The operating system on the server should be upgraded to the latest supported operating system. For more information, see [Minimum operating system requirements](deploy/prerequisites-sensor-version-2#minimum-operating-system-requirements). | High | Sensors health issues tab | All |
+| **Sensor running on an operating system that will soon become unsupported** | The Defender for Identity sensor is running on an operating system that will soon become unsupported. Windows Server 2016 is approaching extended end of support. For more information, see [Legacy operating systems](deploy/prerequisites-sensor-version-2#legacy-operating-systems) and https://aka.ms/mdi/oseos. | The operating system on the server should be upgraded to the latest supported operating system. For more information, see [Minimum operating system requirements](deploy/prerequisites-sensor-version-2#minimum-operating-system-requirements). | Medium | Sensors health issues tab | 2.x |
+| **Sensor running on an unsupported operating system** | The Defender for Identity sensor is running on an unsupported operating system. Windows Server 2012 and 2012 R2 reached end of support on October 10, 2023. For Windows Server 2016 lifecycle guidance, see [Legacy operating systems](deploy/prerequisites-sensor-version-2#legacy-operating-systems). More details can be found at: https://aka.ms/mdi/oseos | The operating system on the server should be upgraded to the latest supported operating system. For more information, see [Minimum operating system requirements](deploy/prerequisites-sensor-version-2#minimum-operating-system-requirements). | High | Sensors health issues tab | All |
| **Sensor has issues with packet capturing component** | The Defender for Identity sensor is using WinPcap drivers instead of Npcap drivers. All customers should be using Npcap drivers instead of the WinPcap drivers. Starting with Defender for Identity version 2.184, the installation package installs Npcap 1.0 OEM. | Install Npcap according to the guidance as described in: https://aka.ms/mdi/npcap | High | Sensors health issues tab | 2.x |
| **Sensor has issues with packet capturing component** | The Defender for Identity sensor is running an Npcap version older than the minimum required version. The minimum Npcap version supported is 1.0. Starting with Defender for Identity version 2.184, the installation package installs Npcap 1.0 OEM. | Upgrade Npcap according to the guidance as described in: https://aka.ms/mdi/npcap | Medium | Sensors health issues tab | 2.x |
| **Sensor has issues with packet capturing component** | The Defender for Identity sensor is running an Npcap component that isn't configured as required. The Npcap installation is missing the required configuration options. | Install Npcap according to the guidance as described in: https://aka.ms/mdi/npcap | High | Sensors health issues tab | 2.x |