Ground Truth field notes · defensive security

Home›Identity Security›Identity threat detection

Section

Identity threat detection

Defender for Identity, directory-attack detection, and the sensors behind it.

Deep diveAugust 14, 2026

Hardening Defender for Identity: sensors and the gMSA service account

Standardizing Defender for Identity sensors across domain controllers (classic vs modern), and moving the sensor service account off Local Service to a Group Managed Service Account with automatic 30-day password rotation.

Read →