Threat Defense for Active Directory doesn't offer the Forensic Report option for an attack that occurs on the Core server
book
Article ID: 184784
calendar_today
Updated On:
Products
Endpoint Protection
Issue/Introduction
Endpoint Threat Defense for Active Directory (TDAD) Forensic Reports are not available as an option if an attack occurs on the Core server where TDAD was installed.
Resolution
At this time, the Forensics Report is disabled on the Core server.