Repeated attempted changes tp DACL since update to CU19 and Hafnium patch

Question

question

WillT-5055 asked Mar 11, '21 ZhengqiLou-MSFT commented Mar 22, '21

Repeated attempted changes tp DACL since update to CU19 and Hafnium patch

Hi all, since the update to the above, I've noticed that every hour, changes are attempted to the DACL for exchange admins to deny exchange trusted subsystem access to those objects. Would anybody know if this is as i suspect, a process that runs since the patch to assist in keeping things 'safe' ?

Thanks

Will

office-exchange-server-administration

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2021-03-11T16:39:16.24Z

AndyDavid answered Mar 11, '21

Are the Exchange Admins in a protected group? This sounds like the SDProp process doing its thing:

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory#sdprop

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 2 · 2021-03-12T05:41:07.687Z

ZhengqiLou-MSFT answered Mar 12, '21 ZhengqiLou-MSFT commented Mar 22, '21

Hi @WillT-5055 ,

Agree with Andy. This is more likely to be expected. You could check it with changing AdminSDProtectFrequency.

https://techcommunity.microsoft.com/t5/microsoft-security-and/active-directory-access-control-list-8211-attacks-and-defense/ba-p/250315

Regards,
Lou

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ZhengqiLou-MSFT · Mar 17, 2021 at 08:54 AM

Hi @WillT-5055 ,

Do the suggestions above help? If the issue has been resolved, please click “Accept as answer” to mark helpful reply as an answer, this will make answer searching in the forum easier and be beneficial to other community members as well.

Regards,
Lou

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 ·

ZhengqiLou-MSFT ZhengqiLou-MSFT · Mar 22, 2021 at 01:12 AM

Hi @WillT-5055 ,

It has been a long time since last reply, did these suggestions help you? If the above suggestion helps, please click “Accept as answer” to mark helpful reply as an answer.Your action would be helpful to other users who encounter the same issue and read this thread.

Regards,
Lou

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 ·

question