User Profile
MarkusOE
Brass Contributor
Joined Jun 28, 2021
User Widgets
Recent Discussions
Re: DMARC hacked bypassed with empty header.from or only semicolon
To me it appears like that "Non-compliant RFC 5322 P2 FROM header detection" in "November 2024 Exchange Server Security Updates" partly addresses my issue. However transport rules would still be needed in order to Honor DMARC. Furthermore it's not clear to me yet, if those transport rules had consequences on emails passing DMARC though detected by this mechanism. Released: November 2024 Exchange Server Security Updates | Microsoft Community Hubhttps://techcommunity.microsoft.com/blog/exchange/released-november-2024-exchange-server-security-updates/4293125DMARC hacked bypassed with empty header.from or only semicolon
WRAP UP On the 26th of September 2024 an email was delivered to one of our Exchange Online mailboxes from the Internet through EOP that spoofes one of our accepted domains although this domain is protected by a DMARC reject policy and by DKIM and SPF nobody as allowed to use this domain as a sender domain. INTRODUCTION Microsoft Support refused to support this case more or less because I insisted on the DKIM and SPF configuration being perfectly fine. They pointed me at community or their paid support. The domain in question (here: spoofeddomain.de) is only kept by me as an accepted domain in Exchange Online for the purpose of receiving email, but for sending email. The MX points at EOP. I have disabled DKIM in order to make sure nobody can get a DKIM pass and to contribute to nobody can get a DMARC pass using this domain as sender domain. For the same reason I have set the SPF record "v=spf1 -all" prohibiting any IP to send in the name of this domain. ANALYSIS Outlook shows the following as sender: f.last@ <spoofeddomain.de email address removed for privacy reasons> Clicking on properties Outlook shows... Displayname: f.last@ Email-Address: spoofeddomain.de email address removed for privacy reasons The Authentication Results Header shows the following: Authentication-Results-Original spf=fail (sender IP is 81.17.30.196) smtp.mailfrom=spoofeddomain.de; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=; CAUSE The attacker seems to be able to work around the mechanism of the EOP that determines the header.from. As a consequence he is able to spoof spoofeddomain.de because the EOP has no header.from domain that it could get a DMARC policy for. If it had, it would have come to a DMARC fail, because we have DKIM disabled and "v=spf1 -all". ASSESSMENT I think the best way to argue Microsoft is right, is to say that spoofeddomain.de is not the actual header.from according to RFC. Furthermore the sender shown in Outlook is not unambigous. However if a user wants to determine the sender domain from this, which domain should he or she determine but spoofeddomain.de? MITIGATION I put transport rules in place that quarntine emails with Authentication-Results or Authentication-Results-Original "header.from=;". However since I have not established a testing process yet, I'm not sure if they will work.SOLVED ADOperationException when Enable-RemoteMailbox with Management Role
I ran into the following error when I was enabling remote mailboxes in a post-hybrid environment using Exchange management tools 2019 (Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn). I found neighboring threads on the Internet, but for this attribute and CMDlet (combination). Solution: proxyAddresses attribute already had a value. After making sure the attribute has no values, I was able to run the command successfully. PS C:\Users\adm-xyz01> Enable-RemoteMailbox 'xyz@domain.custom' -RemoteRoutingAddress 'email address removed for privacy reasons' Enable-RemoteMailbox : Fehler bei Active Directory-Vorgang mit dc.domain.local. Bei diesem Fehler ist kein Wiederholungsversuch möglich. Zusätzliche Informationen: Der Attributwert kann nicht entfernt werden, da er beim Objekt nicht vorhanden ist. Active Directory-Antwort: 00002085: AtrErr: DSID-03152B62, #1: 0: 00002085: DSID-03152B62, problem 1001 (NO_ATTRIBUTE_OR_VAL), data 0, Att 200d2 (proxyAddresses):len 38 In Zeile:1 Zeichen:1 + Enable-RemoteMailbox 'xyz@domain.custom' -RemoteRoutingAddress 'xyz@doma ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Enable-RemoteMailbox], ADOperationException + FullyQualifiedErrorId : [Server=EXMANAGEMENT,RequestId=removed,TimeStamp=removed] [FailureCategory=Cmdlet-ADOperationException] 2F307682,Microsoft.Exchange.Management.RecipientTasks.EnableRemoteMailboxAdding MailboxFolderPermission to certain user fails with Powershell as well as OWA
Hallo! I try to add a MailboxFolderPermission for the assistant to the inbox of the manager. That fails with Powershell as well as Outlook on the web. If instead I grant a MailboxFolderPermission on the managers inbox to my test user that works perfectly fine. We are in a Exchange hybrid setup. However all 3 mailboxes (manager, assistant, test user) are all hosted in Exchange Online (and represented with a RemoteMailbox OnPremise). The assistant changed her last name some time ago (supposedly married). However currently PrimarySmtpAddress = UserPrincipalName OnPremise (RemoteMailbox) as well as Online (UserMailbox). [PS] C:\Windows\system32>Get-ADUser (get-remotemailbox *assistantlastname*).guid.guid -Properties msexchrecipientdisplaytype msexchrecipientdisplaytype : -1073741818 Write-ErrorMessage : |Microsoft.Exchange.Management.StoreTasks.InvalidExternalUserIdException|Der Benutzer "email address removed for privacy reasons" ist entweder keine gültige SMTP-Adresse oder es ist keine übereinstimmende Informationen vorhanden. In C:\Users\adm-xyz02\AppData\Local\Temp\tmpEXO_iq3lu4l0.m3f\tmpEXO_iq3lu4l0.m3f.psm1:1191 Zeichen:13 + Write-ErrorMessage $ErrorObject + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Add-MailboxFolderPermission], InvalidExternalUserIdException + FullyQualifiedErrorId : [Server=GVXP194MB1735,RequestId=777a9f1a-076f-058f-2c1c-f1e6afd8ba64,TimeStamp=Mon, 22 Apr 2024 15:19:43 GMT],Write-ErrorMessage If I use the ExchangeGUID (Exchange Online) of the assistant as identifier, I get the following message: Write-ErrorMessage : |Microsoft.Exchange.Management.StoreTasks.InvalidInternalUserIdException|Der Benutzer "Last, First" wurde in Active Directory gefunden, ihm können aber keine Berechtigungen zugewiesen werden. Versuchen Sie stattdessen ein SMTP-Adresse. In C:\Users\adm-xyz01\AppData\Local\Temp\tmpEXO_iq3lu4l0.m3f\tmpEXO_iq3lu4l0.m3f.psm1:1191 Zeichen:13 + Write-ErrorMessage $ErrorObject + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Add-MailboxFolderPermission], InvalidInternalUserIdException + FullyQualifiedErrorId : [Server=GVXP194MB1735,RequestId=650eac4d-4cf5-73ac-a860-574b4946988d,TimeStamp=Mon, 22 Apr 2024 14:57:04 GMT],Write-ErrorMessage Any ideas how to fix this?Re: Shared Calendars are not loading in Outlook
Some of our users report that, too. My entry point was throttling. Because user reported the same issue some weeks or months ago. And indeed it seems like I can temporarily work around the issue with a script that wipes away all Outlook Windows configuration from the user profile (HKCU Software, appdata and localappdata). However the problem keeps coming back. By the way we have calendar improvements disabled by policy.Re: Cant set smtp tls certificate for send-connector
Summary: Export your certificate including private key as .pfx and then re-import it either using Exchange Management Shell or ECP (not: MMC!). Approved solution method: a) [PS] $bincert = Export-ExchangeCertificate -BinaryEncoded -Thumbprint <Certificate Thumbprint> -Password (Get-Credential).password b) [PS] [System.IO.File]::WriteAllBytes('C:\users\user\desktop\wildcard23.pfx', $bincert.FileData) c) Delete the certificate from your computer using MMC d) [PS] Import-ExchangeCertificate -Server <servername> -FileData ([System.IO.File]::ReadAllBytes('\\localhost\c$\users\user\desktop\wildcard23.pfx')) -Password (Get-Credential).password
