search

microsoft / CSS-Exchange

Exchange Server support tools and scripts
MIT License
1.21k stars 333 forks source link

Rewrite the module Allow list #2010

Closed iserrano76 closed 4 months ago

iserrano76 commented 5 months ago

Issue: In some cases IpcManagedAPIAsync.ni.dll is load in the Exchange process, as the company name is "Microsoft Corp." we need to include that string in the Allow list company. image

Reason: We have some files in the Exchange folders that are not included in the Allow list.

Fix: To avoid this error and future errors I analyzed all files EXE and DLLs in the Exchange folder to extract all company names in 2019/2016 to avoid future issues: 2019: image

2016: image

Additionally, I collected all files without company name to be included in the Allow module list.

Validation: Tested in lab: image

lusassl-msft commented 4 months ago

@iserrano76 I'm not sure how accurate this fix is. This is what I get if I do the same on an Exchange 2019 box:

image

Edit:// I discussed this with @iserrano76 and it looks like my finding was caused by the lab (TDS machine). I've checked a regular Exchange installation, and I can confirm the company names shared in the description of this PR.