Lateral movement report is empty

Question

My ATA Lateral Movement detection scheduled report is empty. It seems to not have the right permissions.

The group policy "Network access: Restrict clients allowed to make remote calls to SAM" is not configured right now - I understand that is the most lenient setting and should allow ATA in? Port 445 is also allowed.

Answer 1

@Alistair Nelson its not a big deal, if there is no lateral movement in your environment you will receive empty email without attachment
ie Lateral movement paths to sensitive accounts or Cleartext passwords exposed using unencrypted LDAP authentications report etc
make sure you are part of "Microsoft Advanced Threat Analytics Administrators" group in ATA server

to check the report from ATA login at ATALOGINURL/reports and follow the below

Answer 2

Did you go over this already ?

https://learn.microsoft.com/en-us/defender-for-identity/install-step8-samr