Skip to main content

AD_DSRM Job

The 0.Collection > AD_DSRM Job collects data related to domain controller registry settings for the DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the Directory Services Restore Mode (DSRM) Admin Account can log in to the domain controller even if it has not been started in DSRM, which can present a potential security vulnerability. Additional information on this registry key is available in this Microsoft Document.

Query for the AD_DSRM Job​

The AD_DSRM Job uses the Registry Data Collector for the following query:

warning

Don't modify this query. The query is preconfigured for this job.

Query Selection

The queries for this job are:

  • Check LSA registry keys – Targets all domain controllers check LSA registry keys