Repeated attempted changes tp DACL since update to CU19 and Hafnium patch

Question

Hi all, since the update to the above, I've noticed that every hour, changes are attempted to the DACL for exchange admins to deny exchange trusted subsystem access to those objects. Would anybody know if this is as i suspect, a process that runs since the patch to assist in keeping things 'safe' ?

Thanks

Will

Answer 1

Are the Exchange Admins in a protected group? This sounds like the SDProp process doing its thing:

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory#sdprop

Answer 2

Hi @Will T ,

Agree with Andy. This is more likely to be expected. You could check it with changing AdminSDProtectFrequency.

https://techcommunity.microsoft.com/t5/microsoft-security-and/active-directory-access-control-list-8211-attacks-and-defense/ba-p/250315

Regards,
Lou

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.