by edward | Nov 21, 2023 | Exchange 2016, Exchange 2019, NMAP, NMAP Scripting Engine, NSE
Performing some tests against my lab Exchange servers, I noticed that Shodan.io revealed information. Take note that attackers also use Shodan.io when enumerating targets. After digging further with NMAP and some scripts, it became more apparent that internal...
by edward | Nov 15, 2023 | Exchange 2016
As an IT Admin, mailbox migrations are a constant thing. Moving users to new databases because you have a new database or you trying clean up and old one with few users, or simply moving to Microsoft 365, there are times when things error out. Errors are not always...
by edward | Nov 12, 2023 | Exchange 2016, Exchange 2019
In the August 2023 Security update (SU) for Exchange Server 2016 and Exchange Server 2019, there was a work around that had to be put in place to remove the Token Cache Module in IIS to mitigate a vulnerability. Microsoft provided the script and you could apply it to...
by edward | Nov 10, 2023 | Exchange 2016
Sometimes the event logs on Exchange servers throw up errors or warnings that do not appear again. The event ID, 4002 for MSExchange Availability is a broad error/warning/informational alert. Looking a the error below, a Proxy request failed with an HTTP status code...
by edward | Nov 8, 2023 | Exchange 2016
As everything relies heavily on DNS and the ability to resolve names to IP’s etc., if your DNS upstream is not working or something firewall/internally is not working, things do not always function as they should and you are presented with false positives. A...
by edward | Nov 7, 2023 | Exchange 2016
In one of my lab machines I was sifting through the log files and came across Event ID 12000 as shown below. As this lab machine does not have internet access at all, the error was a bit strange and no other alerts were raised. Nothing out of the ordinary was done...
