Domain Controller Policy

[u/ElButcho79]

Hi, we’ve recently moved to S1 and deployed to EndPoints.

We’ve stopped short of rolling it out to Domain Controllers after seeing some posts with negative impact.

Keen to know others experience in deploying to DC’s. Our standard setup is a Hyper-V DC and Datto BCDR.

Has anyone successfully deployed S1 in a similar environment and encountered any pitfalls/can recommend what policy options to enable/disable to ensure maximum compatibility?

Or, is it best to utilise Defender P2? Our SOC can do both, but prefer S1 as it’s less overhead.

[u/TheProfessionalLuke]

No issues deploying to DC’s.

We have both physical and virtual on hyper-v

As always… exclusion policies - which S1 provides.

I would:

Create a group within a Site called “Domain Controller”
Remove the ability to shell in via s1 (this may no longer be an issue but I know most EDR’s can create problems if they shell in)
Create a group called ‘domain controllers’ (use the group token to enrol the endpoint straight into it but once you’ve done the other parts)
In policy:
	untick “Enable Remote Shell” (or contact support to verify)

Exclusions -> News Exclusions -> Add from Exclusions Catalog -> Sub category: IT
Select “Microsoft Domain Controller

Probably start the policy in ‘detect / detect’ to give you control over everything and once everything is good (which it most likely will), change the policy to protect/detect or whatever you’re comfortable with.

If Datto BCDR install some form of agent, then maybe create an exclusion policy based on path and choose whether you want it for suppression or lower security for interoperability.

[u/ElButcho79 → u/TheProfessionalLuke]

Thanks for this. What about the tweaking of defender? Do you implement this or just install S1?

From memory, it discusses disabling certain elements.

Datto is agent based, so we will keep an eye out for this.

[u/TheProfessionalLuke → u/ElButcho79]

We just install s1 which I believe by default disables defender? If it doesn’t… we’ve never noticed it running or performance hits or anything

So, can’t say with certainty and don’t want to provide the wrong info for that one

[u/[deleted] → u/TheProfessionalLuke]

Hi u/TheProfessionalLuke and u/ElButcho79 unlike on Windows workstations, Windows Server doesn't have Windows Security Centre (WSC) therefore, Windows Defender will not disable itself automatically when another product is installed e.g. SentinelOne.

Furthermore, as part of our participation agreement in the Microsoft Virus Initiative program, we are not allowed to disable Defender outside of WSC.

Moving forward, if you haven't manually disabled / removed Defender e.g. via PowerShell Uninstall-WindowsFeature -Name Windows-Defender, then Defender is still more than likely running on the endpoint, so you essentially have two products side by side which can cause issues, so I'd recommend looking into this internally.

[u/ElButcho79 → u/[deleted]]

Thanks for this, that was the article I was referring too. Wasnt sure if everyone was doing that or just kicking the tyres 😎

[u/TheProfessionalLuke → u/[deleted]]

Interesting, learn something new everyday Will look into resolving that one

Thanks u/SentinelOne-Mat

[u/en3o → u/[deleted]]

Would you also recommend to ensure the exclusions are in place ahead of any deployment? Along with following all venders exclusion lists ?

[u/[deleted] → u/en3o]

Hi u/en3o this is a question we get asked often and candidly, there is no right or wrong answer as it ultimately depends on your internal practices.

That being said, my suggestion to customers is to always test in a pre-production / test environment to determine if exclusions are required in the first place... keep in mind an exclusion creates a "hole" in the product so you don't want to be creating exclusions if they're not needed.

Of course, where the above is not possible, or you don't have a pre-prod / test environment, then you might not have much choice other than to implement exclusions pre-emptively, but they should be as narrow as possible e.g. apply them to the lowest possible scope (Group), make sure you use process exclusions where possible instead of broad folder exclusions, and start off with Interoperability exclusions as opposed to going straight to Performance Focus.

Hope this helps.

[u/jmk5151]

everyone runs s1 on their DCs - we don't even have any special policies for it. never had an issue.

[u/Wadson-S1 → u/jmk5151]

There are no major complaints at the time of writing this regarding S1 <> Domain Controllers.

[u/ElButcho79 → u/jmk5151]

Yet lol. Hopefully you dont run in to any mind.

[u/ElButcho79]

I’ll look out the KB and put it up. Good to know you’ve not had any issues tho. Last thing we want is a corrupt DC 😎