Agent does not capturing AD events when Azure/O365 template is applied
说明
When running Azure and/or Office 365 auditing on a domain controller in a hybrid environment, you may receive Azure AD and O365 events, but not on-prem Active Directory events
原因
In some instances, the Azure and O365 templates cannot be installed on a domain controller
解决办法
Remove the Azure and O365 templates and configuration from the DC agent and apply to a non-DC agent such as the coordinator machine.