Anything About IT

Learning, Building, Sharing

Exploring IdentityAccountInfo - Building a KQL Query to Assess Identity Password Security Posture

Use IdentityAccountInfo and IdentityInfo in Defender XDR to assess password hygiene, account sensitivity, and risky password policy settings.

Posted by Alex Verboon on Saturday, December 6, 2025

Modern Security for Legacy Systems

How to deploy and manage Microsoft Defender for Endpoint on Windows 7 and Server 2008 R2, including prerequisites, onboarding, and policy management.

Posted by Alex Verboon on Sunday, November 30, 2025

Defender for Identity - Automatic Windows Event Auditing Configuration

How to enable and validate Microsoft Defender for Identity Automatic Windows Event Auditing Configuration and troubleshoot common conflicts.

Posted by Alex Verboon on Saturday, November 22, 2025

Collect Microsoft Entra Connect Sync Audit Events

How to forward Microsoft Entra Connect Sync admin audit events to Microsoft Sentinel using AMA and Windows Security Events via AMA.

Posted by Alex Verboon on Saturday, September 6, 2025

Shedding Light on Dormant Sensitive Accounts

Use Microsoft Defender XDR and KQL to enrich dormant sensitive account findings and add missing account context for remediation.

Posted by Alex Verboon on Tuesday, July 8, 2025

Microsoft Defender for Endpoint - Security Settings Management Internals 0x1

A technical walkthrough of how Defender for Endpoint Security Settings Management works internally on Windows Server, including Entra device objects and dynamic group targeting.

Posted by Alex Verboon on Sunday, April 28, 2024