Home Tech Microsoft tells Exchange admins to remove some previous antivirus restrictions

Microsoft tells Exchange admins to remove some previous antivirus restrictions

by pfuwi
0 comment

Some Microsoft Exchange folders and processes, which the company previously suggested be excluded from antivirus scans for stability reasons, should no longer be excluded, it has announced.

Explaining the change of heart, Microsoft said the processes no longer affect the stability, or the performance, of Exchange servers, adding that it could even be beneficial as some threat actors could have hidden backdoors in there, as well.

Some of the processes and folders include Temporary ASP.NET files, Inetsrv folders, as well as the PowerShell and w3wp processes.

Exclude no more

“Keeping these exclusions may prevent detections of IIS webshells and backdoor modules, which represent the most common security issues,” the Exchange Team said. “We’ve validated that removing these processes and folders doesn’t affect performance or stability when using Microsoft Defender on Exchange Server 2019 running the latest Exchange Server updates.”

The new recommendations affect Exchange Server 2016 and Exchange Server 2013. However, Microsoft added that IT teams should monitor these processes just in case anything goes south. 

Here’s a full list of no-longer-needed exclusions:

  • %SystemRoot%Microsoft.NETFramework64v4.0.30319Temporary ASP.NET Files
  • %SystemRoot%System32Inetsrv
  • %SystemRoot%System32WindowsPowerShellv1.0PowerShell.exe
  • %SystemRoot%System32inetsrvw3wp.exe

Threat actors had been observed using malicious Internet Information Services (IIS) web server extensions and modules, to add backdoors to unpatched Microsoft Exchange servers.

The best way to stay safe is to always apply the latest Exchange patches and updates, to use antivirus programs, restrict access to IIS virtual directories, prioritize alerts, and constantly inspect config files and bin folders for any suspicious files, the publication added. 

Finally, IT teams should always run the Exchange Server Health Checker script after updates, to address any possible misconfiguration issues. 

Exchange Servers are one of the most popular targets for cybercriminals worldwide, as they’re often unprotected, or misconfigured. At the same time, many offer a real treasure trove of sensitive information that can be sold on the black market, or used as leverage in a ransom negotiation.

Via: BleepingComputer

You may also like

Leave a Comment

Our Company

newswebby is where tomorrow is realized. it is the essential source of information and ideas that make sense of a world in constant transformation. the newswebby conversation illuminates how technology is changing every aspect of our lives—from culture to business, science to design. the breakthroughs and innovations that we uncover lead to new ways of thinking, new connections, and new industries.


Subscribe my Newsletter for new blog posts, tips & new photos. Let's stay updated!

Laest News

© 2023  – All Right Reserved. Newswebby