Resolving Microsoft Defender for Identity global health issues

ritmo2k 706

I installed the first sensor on my on-premise domain controller and updated the auditing shortly after.

I now have a couple of global health issues that I have verified to be correctly implemented.

What is the behavior for global health issues, do they not automatically clear when the problem is resolved, or must I always manually resolve them?

Thanks.

health-issue

GARCIA, DAVID 5 Reputation points

2024-01-11T16:53:32.8833333+00:00

I'm having the same problem. In my case, I manually reinstalled the identity sensors and configured the Audit Settings in a GPO according to Microsoft's referenced documentation. All of my sensors are showing a healthy status.

But on the Global Health Issues tab, the "auditing events" error appears for all my domains. What's interesting is that the "generation time" stamps are dated before I ever began reinstalling the sensors. To me it reads as though these error messages are left over from an earlier time. I initially tried closing them, but they've returned.
Fiona Matu 86 Reputation points Microsoft Employee

2024-01-30T12:11:03.0166667+00:00

Hi @ritmo2k , yes, once the issue has been correctly resolved, the issue should automatically clear from the global health issues page. This can however take some time due to latency within the system. You can mark it as closed by clicking on "Close health issue" but that does not fix the issue, it can still recur if the issue was not accurately resolved.