microsoft safety scanner exchange vulnerability

The list is long, but from now on it does not contain: The exclusions should be configured for both memory-resident and file-level scanning. Therefore, excluding these files from being scanned by the Windows antivirus program is very important,” the company explains.

This can cause severe failures in Exchange Server, and it might also generate 1018 event log errors. “The biggest potential problem is a Windows antivirus program might lock or quarantine an open log file or database file that Exchange needs to modify.

Microsoft encourages the use of antivirus software (Microsoft Defender) on Microsoft Exchange servers – if some directories, processes and file name extensions are excluded from the scanning. Also, as the Exchange team pointed out, “Exchange has deep hooks into and permissions within Active Directory, and in a hybrid environment, access to the connected cloud environment.” Which exclusions should you remove? Microsoft Exchange servers are mail servers, so they hold a lot of sensitive corporate information, including information about employees that could be exploited to mount spear-phishing attacks. Microsoft Exchange servers in attackers’ crosshairsĬyber attackers love to target Microsoft Exchange servers, often via zero-day vulnerabilities, but also via known ones.

After having stressed the importance of keeping Exchange servers updated last month, Microsoft is advising administrators to widen the scope of antivirus scanning on those servers.

Microsoft safety scanner exchange vulnerability