Identity Defense Current - User Guide

Introducing Quest Identity Defense Audit
Configuring Audit Working with Audit
Using the Audit Dashboard Searching for specific event data (Quick Search) Working with critical activity Working with searches Managing Reports Working with alerts and notification templates Auditing Microsoft Entra Auditing Microsoft 365
Findings Tier Zero Objects Shields Up Protection (Prevention) Privileged Objects Managing Workload Identities Assessments Hybrid Audit Agentic Defense Identity Defense Settings Appendix - Available Audit Search Columns and Filters Appendix - Identity Defense Indicator Details Appendix - Data Collection Details Appendix - FedRAMP Support Documentation Roadmap

Editing Protection Templates

NOTE:

  • Administrators can edit system templates to:
    • Remove Active Directory objects or Group Policy objects from protection
    • Manage override accounts
  • Users can create and edit their custom templates.
  • You cannot add new protected objects to system templates; you can add objects only to user templates.
  • You cannot rename system templates; only user templates can be renamed.
  • The template type cannot be changed after creation.
  • Predefined override accounts are permanent and cannot be removed.

To edit protection:

  1. Navigate to Defend | Protect | Advanced Protection.
  2. In the Protection table, locate the template you want to view.
  3. Select a single Active Directory or Group Policy template.
  4. Click Edit.
  5. Update the objects, scope, and operations to protect as needed. Review the resulting list of protected objects and remove any that are no longer required.
  6. Click Save and Continue to optionally edit the override accounts.
  7. Add or remove override accounts as required.
  8. Click Save and Finish to apply the updates.

Duplicating Protection Templates

You can create a copy of an existing protection template to customize it for your organization’s needs. This allows you to modify protection settings without changing the original system or user-defined template.

NOTE:

  • Creating or modifying custom protection templates may unintentionally block Active Directory processes from accessing protected objects. Whenever possible, it is recommended to use unmodified system templates.
  • The ability to duplicate a template is enabled only when all of the following conditions are met:
    • Only one protection template is selected.
    • The selected template does not protect:
      • All Group Policies in the forest
      • DomainDNS
  • Duplicated system templates become user-defined templates.
  • Carefully review any changes before enabling a duplicated template to avoid unintended protection or access issues.
  • Disabled templates do not enforce protection until explicitly enabled.
  • Group Policy protection templates that protect "All Group Policies in the forest" cannot be duplicated.
  • Active Directory protection template that protect "DomainDNS" cannot be duplicated.

To duplicate a protection template:

  1. Navigate to Defend | Protect | Advanced Protection.
  2. Select a single Active Directory or Group Policy template.
  3. Click Duplicate.
  4. Click Create to confirm.

The duplicated protection template will have the name "copy of <original_protection_template_name>"

Deleting Protection Templates

Deleting a protection template will stop the protection defined in the template from being enforced in your environment.

NOTE:

  • The Delete option is available only when a User protection template is selected.
  • Multiple User protection templates can be deleted at the same time.
  • The Delete option is disabled when a System protection template is selected.

To delete custom user-defined protection templates:

  1. Navigate to Defend | Protect | Advanced Protection.
  2. In the Protection table, locate the template you want to view.
  3. Select the disabled Active Directory or Group Policy template.
  4. Click Delete.
  5. Confirm the removal by clicking Delete Template.

Active Directory Database Auditing and Protection

The Active Directory Database page allows you to view and manage auditing and protection for Active Directory database (NTDS.dit) access across configured forests.

The Active Directory database (NTDS.dit) stores sensitive identity and security data, including user credentials, group memberships, and access controls. Unauthorized access can lead to credential theft, privilege escalation, or full domain compromise.

Auditing and protection help you:

  • Detect suspicious activity: Track access to the database and identify unusual or unauthorized behavior.
  • Prevent unauthorized access: Block unapproved processes, accounts, or systems from accessing sensitive data.
  • Support investigations: Provide visibility into who accessed the database, from where, and how.
  • Reduce risk exposure: Limit access to only trusted accounts, systems, and processes.
  • Maintain operational continuity: Use exclusions to allow trusted tools (for example, backup or anti-virus software) while protecting everything else.

NOTE: To manage Active Directory Database you need the Can Manage Hybrid Audit Protection permission.

Recommended approach:

  • Enable auditing first to review activity.
  • Identify and configure required exclusions.
  • Enable protection to enforce controls.

To enable and disable Active Directory Database auditing:

  1. Select Defend | Protect | Active Directory Database.
  2. Select a forest, and choose to Enable Auditing (or Disable Auditing).
  3. Confirm your selection.

To configure exclusions:

NOTE:

  • Remote processes cannot be excluded.
  • Processes excluded from protection are also excluded from auditing.
  1. Select Defend | Protect | Active Directory Database.
  2. Select a domain, and choose to Add Exclusions.
  3. Add and remove exclusions as required.
  4. Confirm your selections.

To enable and disable protection:

NOTE:

  • Enabling protection automatically enables auditing if not already enabled.
  • If auditing is enabled, selecting protection enables Active Directory database protection on all domain controllers. Review audit events and configure exclusions before enabling protection.
  • Disabling Active Directory database protection disables it on all domain controllers.
  • Auditing cannot be disabled while protection is active.
  1. Select Defend | Protect | Active Directory Database.
  2. Select a forest, and choose to Enable Protection (or Disable Protection).
  3. Confirm your selection.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating