This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(169.60000000000002, 91%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EB%3C/text%3E%3C/svg%3E)
In my campagny we need to deploy Microsoft ATA, and we have two sites, one where i have ATA gateway and other site i have ATA centre and lighweight gateways, could we have encryption between the ATA centre and ATA gateway?
Other Configuration Manager-related features and issues
Answer accepted by question author
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 77%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEO%3C/text%3E%3C/svg%3E)
Encryption is built in, as by default the Gateway-Center communication is done via TLS on port 443.
Are you aware that ATA is in extended support? have you checked the option to use MDI instead ?
Thank you Eli
On emore question : is the sizing phase mandatory? or i can give as much as i can for both gateways and the centre? because Our DC is critical and we are afraid of having some trouble when we are running the sizing tool in the DC with admin privilege
It is not advised to skip the sizing tool, it can lead to many unexpected issues later.
You don't need to run the tool on the DC itself, you can run it remotely as domain admin, it's just collecting perf data and should cause no harm to the DC.
The unexpected issues is related to server resources (Memory, RAM, disk..) or something else? what we are thinking is give more resources to those VMs and whenever its needed we can add or reduce resources
For the sizing tool is it sending something out of the compagny to the cloud or is on-premise solution?
Gateways will not work well with changing resources dynamically. actually, the docs says you need to make sure both CPU and memory are fixed.
I advise to use the tool. It will not send any info to the cloud, the data is collected locally, and then converted to excel, nothing more.
Thank you Eli for your valuable support.
As i said we have two site in each one we have DCs , and we can't use the port miroring between the two site(Security reason), is it ok to have two ATA gateway, one gateway in each site? because we won't use the lightweight gateways.
Sure, you can have as many gateways as you want. Only the Center must be a single instance.
Hello, When i run the tool its failed with the error message:
Failed obtain instances of performance counter 'network Interface'
from machine XXXX
Access denied
Either you don't have permissions or this category is missing from the counters on the machine, in which case you will need to fix the counters.
Which access my VM need to have to run the tool ?
In the capacity sizing i couldn't find the gateways storage ?
The gateway storage is fixed, it's in the docs.
https://learn.microsoft.com/en-us/advanced-threat-analytics/ata-prerequisites#ata-lightweight-gateway-requirements
"A minimum of 5 GB of space is required and 10 GB is recommended. This includes space needed for the ATA binaries, ATA logs, and performance logs."
can we use ATA getways without port mirroring to the ADs ?
No, if the gateway is not lightweight (installed on the DC itself) installing it on a standalone machine without port mirroring won't work well.
Installing a lightweight gateway in the DC has any impact ? i m strugling that the AD services may impact by the lightweight gateway, and from security perspective which gateway is the most recommended ?
For ATA both options will give you the same detections, in MDI the integrated one is by far better.
Yes, the Gateway when installed on the DC will consume significant resources, and it also supports less traffic compared to the standalone option in ATA.
While we have resource management protection that will ensure 15% free CPU and memory at all times (as long as the Gateway is the one holding the resources)
I suggest to run the sizing tool first, and see if it's applicable for the machine , if it will be supported traffic wise or if hardware spec will need to be bumped up.
When configuring WEF, is a copy of logs will be sent to ATA Gateway and a copy will be still in the DC , or no logs will be in teh DC after forwarding ?
It should leave a copy.
For senstives groups: the ones that marked with S in green is by default senstive? is not required to add them to the configuration of senstives groups?