Exchange Zero days are very common these days and there is a freshly baked one today (30th September 2022 as of writing). If you want to know what how the vulnerabilities work, take a look at the reference at the bottom. As a sysadmin I care about securing my systems.

Here are a few steps to mitigate this zero day vulnerability:

In IIS Manager on the Exchange Server, select the Autodiscover virtual directory and open URL Rewrite and add a new rule.

Select Request Blocking

Enter the string

.*autodiscover\.json.*\@.*Powershell.*

Using should be changed to Regular Expression.

Change URL to REQUEST_URI and save the changes.

References:

https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/

Windows Server 2022 is new and has to be the best Windows Server there is right? Not at all. Microsoft has added a recovery partition (like in Windows Client versions) that prohibits you from expanding the boot disk like you usually would in older Windows Server versions.

Anyway, here are a few diskpart commands that will help you delete the recovery partition and allow you to expand the boot disk:

diskpart

list disk

select disk 0

Make sure partition 4 is the 523MB Recovery partition

select partition 4

delete partition override

References:

https://www.diskpart.com/diskpart/delete-partition-4125.html

If UAC is enabled and Admin Approval Mode is enabled for the built-in Administrator for example, you might have problems accessing network drives from an elevated command prompt. This behavior is expected, since in Admin Approval Mode all apps run as a standard user by default. If a program is elevated, it runs under a different session than the non-elevated user.

Microsoft suggests following fixes or workarounds:

1. Remap network drives via bat file or manually
2. Create this registry key, which creates a link between both sessions:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DWORD EnableLinkedConnections 1

References:

https://docs.microsoft.com/en-us/troubleshoot/windows-client/networking/mapped-drives-not-available-from-elevated-command

Just recently I learned that Microsoft ClickOnce Applications are a pain in the ass and cannot be published as Published Applications the usual way through Citrix Virtual Apps and Desktops.

Usually the message below shows up before starting or installing the application (which is on a user basis – I absolutely hate that. Thanks for that Microsoft and Developers). If you try to publish the file ending with .application nothing will happen.

Creating a BAT file and publishing that bat file will show the prompt and the desired application will start:

cd /d “C:\Windows\Microsoft.NET\Framework\v4.0.30319”

start dfsvc.exe

start “C:\Program Files (x86)\Internet Explorer\iexplore.exe” “http://webserver/app”

This does also work:

start “C:\Program Files (x86)\Internet Explorer\iexplore.exe” “\\fileserver\share$\bestsoftware.application”

Kudos:

https://www.nomadit.xyz/clickonce-prompt-for-citrix-published-app/

A good backup tool uses VSS Writers to achieve application consistent backups, which also truncates transaction log files. You can also achieve that without having to do a backup. Here are the few commands:

diskshadow

You can add multiple volumes, if database and log files are located on different disk drives:

add volume D:

add volume E:

begin backup

create

end backup