Non Domain Controller Active Directory Replication (Windows Security Events/Analytic Rules/NonDCActiveDirectoryReplication)

[jlextremeiro]

In the Solutions/Windows Security Events/Analytic Rules/NonDCActiveDirectoryReplication.yaml
the condition
//| where Computer in (DCServersList)
Shouldn't be
//| where Computer !in (DCServersList).

[v-visodadasi]

Hi @jlextremeiro , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

[v-visodadasi]

Hi @jlextremeiro , Can you please provide more details and In commented query it already defined as //| where Computer in (DCServersList). So, Could you please provide clarification on this.

[v-visodadasi]

Hi @jlextremeiro , Could you please provide clarification on this?

[v-visodadasi]

Hi @jlextremeiro , since we have not received a response in the last 5 days, we are closing your issue as per our standard operating procedures. If you still need support for this issue, feel free to re-open at any time.

Thank you for your co-operation.