Anything About IT

Learning, Building, Sharing

Exploring IdentityAccountInfo - Building a KQL Query to Assess Identity Password Security Posture

Use IdentityAccountInfo and IdentityInfo in Defender XDR to assess password hygiene, account sensitivity, and risky password policy settings.

Posted by Alex Verboon on Saturday, December 6, 2025

Defender for Identity - Automatic Windows Event Auditing Configuration

How to enable and validate Microsoft Defender for Identity Automatic Windows Event Auditing Configuration and troubleshoot common conflicts.

Posted by Alex Verboon on Saturday, November 22, 2025

Collect Microsoft Entra Connect Sync Audit Events

How to forward Microsoft Entra Connect Sync admin audit events to Microsoft Sentinel using AMA and Windows Security Events via AMA.

Posted by Alex Verboon on Saturday, September 6, 2025

Shedding Light on Dormant Sensitive Accounts

Use Microsoft Defender XDR and KQL to enrich dormant sensitive account findings and add missing account context for remediation.

Posted by Alex Verboon on Tuesday, July 8, 2025

Microsoft Defender for Endpoint - Security Settings Management Internals 0x1

A technical walkthrough of how Defender for Endpoint Security Settings Management works internally on Windows Server, including Entra device objects and dynamic group targeting.

Posted by Alex Verboon on Sunday, April 28, 2024

Assessment and Control of Browser Extensions

How to assess, hunt, and control browser extensions with Microsoft Defender for Endpoint and policy controls.

Posted by Alex Verboon on Sunday, June 19, 2022