All of them are Internet-facing. I have done a lot of patching and some restoring from backup (followed by parching) this week. Some people disabled /ECP facin

All of them are Internet-facing. I have done a lot of patching and some restoring from backup (followed by parching) this week. Some people disabled /ECP facing the Internet. It was "unsupported" by MSFT so I never did that. In retrospect it would have been worth the gamble. If I had it to do over again I would have taken that bet. None of the compromised boxes I saw this week showed signs of post-exploit activity. They dropped their payload and left. Every compromised box was restored from backup, temporarily isolated from the Internet, and patched.