DC Sensor Reference
This section is the technical reference for the AuthNull DC sensor. The sensor runs on your Domain Controllers and enforces MFA for Active Directory sign-ins.
For the setup steps in the console, see Connect Identities and Install the DC Sensor.
Why "agentless"?
"Agentless" means no agents on workstations, laptops, or servers. The sensor runs only on the Domain Controllers. Your endpoints, network layout, and AD configuration stay the same. There are no proxies and no GPO changes.
What it does
The sensor watches authentication on the DC. For each sign-in, it asks AuthNull for a verdict. If the verdict is MFA, the user gets a push from your MFA provider: Duo Security or Okta Verify. AuthNull Authenticator is coming soon.
- Approve the push — the sign-in goes through.
- Deny or ignore the push — the identity source's Fallback setting applies (see below).
Protocol coverage
| Protocol | How the sensor sees it |
|---|---|
| Kerberos (AS and TGS) | Security Event Log |
| NTLM | Event 4776 and the AuthnullSSP security package (LSA) |
| LDAP binds | Security Event Log and Windows Filtering Platform (WFP) |
| SMB | Windows Filtering Platform (WFP) |
| RDP (Network Level Authentication) | Through the Kerberos or NTLM sign-in it performs |
WinDivert packet interception is optional. It is not enabled in the generated sensor.yml (windivert_enabled: false, and tgs_protected_spns is empty). Coverage that depends on WinDivert is off unless you turn it on.
How a verdict is decided
| Topic | Behavior |
|---|---|
| Monitor / Enforce | Decided on the AuthNull server from the identity source's Mode. Change it on Identity Sources. It takes effect on the next sign-in. |
| No matching policy | The sign-in is allowed. See Policies. |
| Monitor mode | Every verdict becomes allow. No push is sent. |
| Push wait | The sensor waits up to 60 seconds for the push (mfa_timeout_seconds: 60). |
| Approval reuse | An approval is remembered for 5 minutes (allow_deduplication_window_ms: 300000). Users are not pushed for every ticket. |
| Denied, expired, or timed-out push | Resolves to the Fallback setting. |
| AuthNull unreachable | After 5 consecutive failures, the sensor applies Fallback to every sign-in. |
| User has no enrolled device | The sensor applies unenrolled_action. This is not shown in the UI. |
With Fallback = Allow, a denied push can still let the user in. Use Fallback = Deny if a denied push must block access.
Setting mode: monitor locally in sensor.yml is an emergency kill switch. It makes the sensor allow everything, regardless of the server setting.
Architecture
Users and devices
│
│ Kerberos / NTLM / LDAP / SMB
▼
Domain Controller
│
├──► AuthNull DC Sensor (+ AuthnullSSP)
│ │
│ ├── Verdict request to AuthNull
│ ├── MFA push (Duo Security / Okta Verify)
│ └── Allow / Deny
│
▼
Active Directory
Key facts
| Item | Details |
|---|---|
| Where it runs | Every Domain Controller that handles logons. |
| Reboot | Required after install. NTLM enforcement starts only after the reboot. |
| Service | AuthnullDCSensor ("Authnull DC Sensor"), automatic start. |
| Directory sync | The sensor pushes users, groups, and OUs every 10 minutes. |
| Health | A sensor counts as live if it sent an event in the last 15 minutes. |
In this section
Start with the identity source in Monitoring. Watch Logs, test with Dry run, then switch to Enforcing.