Installation
The install steps are in Install the DC Sensor. This page adds what the installer does and how to verify it.
Quick steps
- On Install DC Sensor, click Download sensor.yml and Download install.ps1. Save both in the same folder on the DC.
- Open PowerShell as Administrator in that folder and run
.\install.ps1. - Answer the reboot prompt. Reboot the DC.
- Repeat on every Domain Controller.
sensor.yml is tenant-specific. Keep it private. Do not commit it to version control.
What install.ps1 does
| Item | Details |
|---|---|
| Install folder | C:\Program Files\Authnull\DCSensor |
| Config | C:\ProgramData\Authnull\sensor.yml |
| Downloads | The sensor, WinDivert files, and AuthnullSSP.dll (to System32), from GitHub |
| LSA package | Registers AuthnullSSP |
| Service | AuthnullDCSensor ("Authnull DC Sensor"), automatic start |
| Recovery | Restarts on failure after 5 s, 10 s, then 30 s |
| Reboot | Asks "Reboot now? (y/n)" |
A Domain Controller reboot is required. NTLM enforcement starts only after the reboot.
Verify
Check the service:
Get-Service AuthnullDCSensor
The status should be Running.
Then check the console:
- Open Identity → Identity Sources.
- The Sensors column shows the DC hostname once the sensor reports an event. With several DCs it shows "N of M live".
- The Protection column shows "Monitoring only" or "Protected". "Not protected" means no sensor is reporting.
- Last Sync changes from "Never synced" after the first directory sync. The sensor syncs every 10 minutes.
There is no separate heartbeat. A sensor counts as live if it sent an authentication event in the last 15 minutes. Sign in with a domain account to generate one.
Test in Monitor mode
New identity sources start in Monitor. Every sign-in is allowed and no push is sent.
- Sign in to a domain-joined machine with an AD account.
- Confirm the event in Logs.
- Build Policies and test them with Dry run.
- On Identity Sources, set Mode to Enforcing.
Change settings later
Sync scope and Fallback are written into sensor.yml at download time. There is no screen to edit them. To change them, download a new sensor.yml, replace C:\ProgramData\Authnull\sensor.yml, and restart the service:
Restart-Service AuthnullDCSensor
Monitor / Enforce is different. It is set on the server and needs no new download.
Upgrade
Re-run install.ps1. The installer replaces the existing service.
Uninstall
There is no uninstall script yet. Contact AuthNull support before removing the sensor from a Domain Controller.