Install the DC Sensor
The DC Sensor is the AuthNull component on your Domain Controller. It asks AuthNull about each authentication and applies the verdict.
You reach this step after Save & Continue in Connect Identities.
The installer registers an LSA package, AuthnullSSP. NTLM enforcement starts only after the Domain Controller reboots. Plan a maintenance window.
Install the sensor on each Domain Controller that handles logons. A sign-in handled by a DC without the sensor is not checked by AuthNull.
Step 1 — Download the files
Click Download sensor.yml and Download install.ps1. Put both files in the same folder on the Domain Controller.
| File | Purpose |
|---|---|
sensor.yml | Tenant-specific configuration for this domain. Includes the sync scope and Fallback setting. |
install.ps1 | The PowerShell installer. |
sensor.yml is tenant-specific. Keep it private. Do not share it or commit it to version control.
Step 2 — Run the installer
Open PowerShell as Administrator on the Domain Controller. Go to the folder with both files and run:
.\install.ps1
Step 3 — Verify
Check the service is running:
Get-Service AuthnullDCSensor
The status should be Running. Then click Done.
What install.ps1 does
| Item | Detail |
|---|---|
| Install folder | C:\Program Files\Authnull\DCSensor |
| Config file | C:\ProgramData\Authnull\sensor.yml |
| Downloads | The sensor, WinDivert files and AuthnullSSP.dll (into System32), from GitHub. |
| Service | Display name Authnull DC Sensor, service name AuthnullDCSensor. |
| Start type | Automatic. |
| Restart policy | Restarts on failure after 5 s, 10 s, then 30 s. |
| Reboot | Asks Reboot now? (y/n) at the end. |
Network requirements
| From | To | Why |
|---|---|---|
| Domain Controller | AuthNull | Authentication decisions, user sync and events. |
| Domain Controller | GitHub | Installer downloads only. |
After install
The sensor appears in the Sensors column on Identity Sources once it reports authentication events.
A sensor counts as live if it sent an event in the last 15 minutes. There is no separate heartbeat. On a quiet DC, sign in once to generate an event.
The sensor also syncs users, groups and OUs every 10 minutes.
Upgrade
Re-run install.ps1. It replaces the existing service.
Change settings
To change sync scope or Fallback, download a new sensor.yml. Replace C:\ProgramData\Authnull\sensor.yml and restart the service:
Restart-Service AuthnullDCSensor
Uninstall
There is no uninstall script yet.
Next steps
- Identity Sources — confirm the sensor is live.
- Policies — decide who gets MFA.
- DC Sensor Reference — how the sensor works in depth.