Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
175 questions
The Defender for Identity sensor(s) listed are failing to resolve IP addresses to device names
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(217.60000000000002, 44%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAC%3C/text%3E%3C/svg%3E)
Alessandro Cassano
0
Reputation points
Good morning, I received this message from Azure alerts
The Defender for Identity sensor(s) listed are failing to resolve IP addresses to device names using the configured protocols (4 protocols), with a success rate of less than 10%. This could impact detection capabilities and increase the number of false positives (FPs). Details ArcaDCAzure.service.local Generated time Jan 3, 2024 4:48 PM Last Updated Jan 3, 2024 4:48 PM Recommendations Check that the sensor can reach the DNS server and that Reverse Lookup Zones are enabled. Check that port 137 is open for inbound communication from MDI sensors, on all computers in the environment. Check that port 3389 is open for inbound communication from MDI sensors, on all computers in the environment. Check that port 135 is open for inbound communication from MDI sensors, on all computers in the environment. Check all network configuration (firewalls), as these could prevent communication to the relevant ports. Learn more about https://aka.ms/mdi/nnr/troubleshooting.
I checked the opening of ports 135 and 3389 in inbound and they are open
Port 137 seems not open although I don't understand why the firewall is disabled
and Azure rules allow inbound on all ports
Can you help me ? Thanks