Prerequisites
Check these requirements before you install the DC sensor.
Domain Controller
| Requirement | Details |
|---|---|
| Operating system | Windows Server 2016, 2019, or 2022 |
| Role | Domain Controller |
| Architecture | 64-bit only |
| Permissions | Run the installer from PowerShell as Administrator on the DC |
| Reboot window | The DC must be rebooted after install. Plan a maintenance window. |
warning
Install the sensor on every Domain Controller that handles logons. Clients sign in at whichever DC they reach. A DC without the sensor is a gap in coverage.
Network
| Requirement | Details |
|---|---|
| Outbound HTTPS to AuthNull | The sensor sends verdict requests and directory sync to your AuthNull server. |
| Outbound HTTPS to GitHub | The installer downloads the sensor, WinDivert files, and AuthnullSSP.dll from GitHub. Needed only while installing or upgrading. |
| No inbound ports | The sensor does not listen on any inbound port. |
To test connectivity from the DC, replace the host with your AuthNull server:
Test-NetConnection -ComputerName <your-authnull-host> -Port 443
You should see TcpTestSucceeded: True.
AuthNull setup
- The domain is added on Identity Sources with Add identity source → Active Directory. See Connect Identities.
- An MFA provider is configured: Duo Security or Okta Verify. AuthNull Authenticator is coming soon. See MFA Providers.
- Users are enrolled with that provider.
Windows audit policy
The sensor reads the Windows Security Event Log. Make sure audit logging is on:
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
To check:
auditpol /get /subcategory:"Logon"
The result should show Success and Failure.
Next: Installation.