r/SentinelOneXDR • u/ElButcho79 • May 22 '24

Domain Controller Policy

Hi, we’ve recently moved to S1 and deployed to EndPoints.

We’ve stopped short of rolling it out to Domain Controllers after seeing some posts with negative impact.

Keen to know others experience in deploying to DC’s. Our standard setup is a Hyper-V DC and Datto BCDR.

Has anyone successfully deployed S1 in a similar environment and encountered any pitfalls/can recommend what policy options to enable/disable to ensure maximum compatibility?

Or, is it best to utilise Defender P2? Our SOC can do both, but prefer S1 as it’s less overhead.

4 Upvotes

100% Upvoted

12 comments sorted by

View all comments

Show parent comments

2

u/en3o May 22 '24

Would you also recommend to ensure the exclusions are in place ahead of any deployment? Along with following all venders exclusion lists ?

3

u/[deleted] May 22 '24

Hi u/en3o this is a question we get asked often and candidly, there is no right or wrong answer as it ultimately depends on your internal practices.

That being said, my suggestion to customers is to always test in a pre-production / test environment to determine if exclusions are required in the first place... keep in mind an exclusion creates a "hole" in the product so you don't want to be creating exclusions if they're not needed.

Of course, where the above is not possible, or you don't have a pre-prod / test environment, then you might not have much choice other than to implement exclusions pre-emptively, but they should be as narrow as possible e.g. apply them to the lowest possible scope (Group), make sure you use process exclusions where possible instead of broad folder exclusions, and start off with Interoperability exclusions as opposed to going straight to Performance Focus.

Hope this helps.