Defender for Identity (a.k.a Azure ATP) Deployment Best practices
Published: 2021-01-02 03:07:41

So, you are going to deploy Microsoft Defender for Identity? (previously known as Azure ATP), make sure you check this little summary so you make sure you don't miss any important point, and make the best use of this product!

### Best Practice #1 - Don't rush into installation, read and plan!

Defender for Identity (MDI for short) deployment, seems to be pretty straightforward right? Just download the tool and install it on all Domain Controllers... Well, it's not that easy. As with any product or service, understanding the product and planning correctly is key for success. I recommend reading these articles before rushing into downloading and installing stuff:

 - Defender for Identity Architecture | [link](https://docs.microsoft.com/en-us/defender-for-identity/architecture)
 - Defender for Identity Pre-requisites | [link](https://docs.microsoft.com/en-us/defender-for-identity/prerequisites#before-you-start)

### Best Practice #2 - Check your DCs meet some minimums

Validate that your Domain Controllers, meet at least these min specs:

| Cores | RAM |
|---|---|
|2 cores |6 GB |


### Best Practice #3 - No Dynamic Memory

- If Domain Controllers are Virtual, validate no dynamic memory is enabled. More info: [VMWare Memory Balloning](http://www.vfrank.org/2013/09/18/understanding-vmware-ballooning/) / [Hyper-V Dynamic Memory](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831766(v=ws.11)) 
  
### Best Practice #4 - Configure Domain Controllers Audit Policy

MDI uses AD event logs (as well as ETW traces, and network monitoring) to gather its data. So be sure to collect the right events for key AD activity:

- [Audit Policy for MDI](https://docs.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection)

### Best Practice #5 - Make sure you collect NTLM audit logs

In order to maximize MDI resolution and accurancy, it is important to collect NTLM Auditing logs (EventID 8002):

- [Audit Policy for MDI](https://docs.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection#configure-audit-policies)
- [NTLM Auditing Technet blog](https://docs.microsoft.com/en-us/archive/blogs/askds/ntlm-blocking-and-you-application-analysis-and-auditing-methodologies-in-windows-7)


### Best Practice #6 - Consider your proxy requirements

Azure ATP needs to talk to the internet to send its data to the AI data analysis service. Domain Controllers should never have Internet access, so you will probably need to setup a proxy to allow these destinations. Consider reading this article to check the proxy requirements:

- [Defender for Endpoint Proxy Requirements](https://docs.microsoft.com/en-us/defender-for-identity/configure-proxy)

### Best Practice #7 Enable SAM-R for full Lateral Movement Path detection

Defender for Identity builds its lateral movement path graph based on AD group membership and also local group membership.
In order to make Azure ATP able to discover local groups, you need to make the Azure ATP AD account able to query machines SAM databases. We have a GPO for that in place (Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network Access: Restrict clients allowed to make remote calls to SAM), make sure you have your Azure ATP account added there:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/n6xhoejqg1hpzd9zh2cp.png)


![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/q9ry46h8tjt36ghhwib9.png)

More info:

 - [Configure Defender for Identity to make remote calls to SAM](https://docs.microsoft.com/en-us/defender-for-identity/install-step8-samr)
 - [Network Access: Restrict clients allowed to make remote calls to SAM](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls)


### Conclusion - Read read read before adopting the solution

Any Security solution (or any IT solution in general) requires proper planning, this article just enumerates a couple of points that are overseen when adopting the solution. However we insist on reading as much documentation as posible before deploying any solution. See you!