FAQ
General
Do I need to install anything on workstations?
No. The sensor runs only on Domain Controllers. That is what "agentless" means.
Which Windows Server versions are supported?
Windows Server 2016, 2019, and 2022, 64-bit. No specific AD functional level is required.
Does it work with Entra ID?
The DC sensor is for on-premises Active Directory. Entra ID is added separately on Identity Sources (Add identity source → EntraID) and synced by the server every 5 minutes. Sign-ins handled in the cloud do not pass through the DC sensor.
Can I run it on a read-only Domain Controller (RODC)?
Install it on your writable Domain Controllers. They process the authentications.
Do I need it on every DC?
Yes. Install the sensor on every Domain Controller that handles logons. Clients sign in at whichever DC they reach. Sign-ins at a DC without the sensor are not evaluated.
Do I need to reboot?
Yes. The installer registers the AuthnullSSP LSA package. NTLM enforcement starts only after the DC reboots.
Authentication and MFA
Which protocols are covered?
| Protocol | Coverage |
|---|---|
| Kerberos AS (TGT) | Yes |
| Kerberos TGS (service tickets) | Yes, seen in the event log |
| NTLM | Yes (event 4776 and AuthnullSSP) |
| LDAP binds | Yes |
| SMB | Yes, via Windows Filtering Platform |
| RDP (NLA) | Through the Kerberos or NTLM sign-in it performs |
WinDivert packet interception is optional and off in the generated config.
Does it protect SMB file shares?
Yes, for domain users. Two cases are not covered without an endpoint agent:
- Local account SMB — the DC is not involved.
- Tickets already issued — the DC is not asked again until the ticket expires.
How do Monitor and Enforce work?
The AuthNull server decides, based on the identity source's Mode on Identity Sources. Changing it takes effect on the next sign-in. No new download is needed. In Monitor, every sign-in is allowed and no push is sent.
Will users get a push for every file share access?
No. After a user approves a push, the approval is reused for 5 minutes. Ticket renewals and background activity in that window do not trigger new pushes.
How long does the sensor wait for a push?
Up to 60 seconds. After that, the push counts as timed out.
What happens if the user denies the push or it times out?
A denied, expired, or timed-out push resolves to the identity source's Fallback setting. With Fallback = Allow, the user still gets in. With Fallback = Deny, the sign-in is blocked.
What happens if a user has no enrolled device?
The sensor applies unenrolled_action from sensor.yml. This setting is not shown in the console.
What happens if AuthNull is unreachable?
After 5 consecutive failures, the sensor applies the Fallback setting to every sign-in. The default is Allow. The sensor recovers on its own when connectivity returns.
What if no policy matches a sign-in?
It is allowed, in both Monitor and Enforce.
Can I exclude a user or service account from MFA?
Yes, with a policy. Create an Allow policy scoped to that user (AD users) on Policies. You can narrow it further by protocol, source, or destination.
Are machine accounts sent for MFA?
No. Accounts ending in $ are filtered out.
Performance and reliability
What is the impact on sign-in time?
In Monitor: negligible. Every sign-in is allowed and no push is sent.
In Enforce: a sign-in that needs MFA waits for the user to answer the push, up to 60 seconds. A sign-in that needs no MFA waits only for the verdict.
Is the sensor a single point of failure?
If AuthNull cannot be reached, the Fallback setting decides. With Fallback = Allow, sign-ins continue. The service restarts automatically on failure after 5, 10, then 30 seconds.
Is there an emergency off switch?
Yes. Set mode: monitor in C:\ProgramData\Authnull\sensor.yml and restart the service. The sensor then allows everything, regardless of the server setting. Remove it to return to normal.
Security
Can an attacker bypass the sensor by going around the DC?
Domain Kerberos and NTLM sign-ins must reach a Domain Controller. If every DC has the sensor, there is no DC without coverage. The SMB exceptions above still apply.
Does the sensor store credentials?
No. It sends event metadata (user, source IP, protocol, destination, time) to AuthNull. It does not store passwords or hashes.
What permissions does the sensor need?
Administrator rights on the DC to install it. Outbound HTTPS to AuthNull, and to GitHub during install.
Can I permanently whitelist a user in a local file?
No. The AD whitelist is retired. Use a policy instead, such as an Allow policy scoped to that user. If a policy targets a user but does not cover a particular sign-in, that sign-in is allowed and the reason is logged.
Installation and operations
How do I upgrade the sensor?
Re-run install.ps1 on each DC. The installer replaces the existing service.
How do I change sync scope or Fallback?
Download a new sensor.yml from the console, replace the file in C:\ProgramData\Authnull\, and restart the AuthnullDCSensor service.
How do I uninstall it?
There is no uninstall script yet. Contact AuthNull support.
Where do I see sign-in events?
In Logs (page Access Logs). It shows raw sensor events.
How can I test without affecting users?
Keep the identity source in Monitoring. Every sign-in is allowed and recorded in Logs. Test policies with Dry run on the review step, then switch the source to Enforcing.