Script for cleanup: GitHub – SammyKrosoft/Clean-ExchangeLogs: Script from Edward van Bilkon, Microsoft Most Valuable Professional, to cleanup Exchange log files (Exchange 2013, 2016, 2019) (if done so, maybe restore it from backup and do some research). If you are one of the few which have a GREEN output, it is possible that you have not been attacked, or you cleared your logs and the script did not find the relevant information. I’ll try to explain them in this section.įirst use the Github Script Test-ProxyLogon.ps1 to check your exchange. Mostly the hackers leave some kind of traces behind, where you can find them. One simple answer, maybe someone broke into your exchange and you didn’t even notice. NOTE: executing MSPs will work, if you use an administrative cmd to start them, otherwise there can be update issues with UAC (user account control). If your exchange is installed on latest CU, you only need to install the patch (can be done via Windows Updates) or you can manually download it at this link: Īnother PDF treating update process and some kind of important information. UPDATE is the only answer and do it FAST! If you have questions, see this graph from MS What can you do to check your exchange and much more important, what to do if you have been hit by this. Exchange Servers have been compromised with Backdoors and other malware (I’ve seen it several times). The “0day” exploit HAFNIUM was available for exchange 2010 – 2019, so every exchange admin who published exchange was vulnerable. The last few days lot of people around the globe, had some issues with patching and securing Microsoft Exchange Onpremis servers.

Ms exchange 2016 download