Skip to main content

Set-XdrIdentityConfigurationRemediationActionAccount

SYNOPSIS​

Configures the remediation action account type for Microsoft Defender for Identity.

SYNTAX​

Set-XdrIdentityConfigurationRemediationActionAccount [[-UseLocalSystem] <Boolean>]
 [-ProgressAction <ActionPreference>] [-WhatIf] [-Confirm] [<CommonParameters>]

DESCRIPTION​

Sets whether Microsoft Defender for Identity uses the Local System account or a dedicated account for remediation actions. This configuration determines which account type is used when MDI performs automatic remediation actions on identified threats.

EXAMPLES​

EXAMPLE 1​

Set-XdrIdentityConfigurationRemediationActionAccount -UseLocalSystem:$true
Configures MDI to use the Local System account for remediation actions.

EXAMPLE 2​

Set-XdrIdentityConfigurationRemediationActionAccount -UseLocalSystem:$false
Configures MDI to use a dedicated account for remediation actions.

PARAMETERS​

-UseLocalSystem​

Boolean parameter that controls whether remediation actions use the Local System account. Defaults to $true. Use -UseLocalSystem:$false to configure a dedicated remediation account.

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: True
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf​

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm​

Prompts for confirmation before creating each rule.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

Object​

Returns the configuration response from the API.​

NOTES​

After switching to a dedicated account, you need to use New-XdrIdentityConfigurationRemediationActionAccount to register the account credentials.