3 ms·
Something interesting I learned when looking into all of this is that if you have a large environment (2000+ mailboxes) and transition to Exchange Online, Micro
by easton 6y ago
Something interesting I learned when looking into all of this is that if you have a large environment (2000+ mailboxes) and transition to Exchange Online, Microsoft still (since 2010) has no idea on how to fully decommission your Exchange Server environment, since you need at least 1 to facilitate on-prem AD connectivity (which isn’t true if you didn’t have a hybrid environment). So even if you transitioned to the cloud, you may not have been safe.
https://docs.microsoft.com/en-us/exchange/decommission-on-premises-exchange https://docs.microsoft.com/en-us/exchange/decommission-on-pr...
- tgragnato 6y agoThe whole AD security model is outdated. When something is wrong with any of a domain's services, your organization is breached. There is variation in details like in how to exploit vulnerabilities or how to move laterally... But AD is a SPOF, cloud or not.
- lc9er 6y agoThis is a major unresolved issue. Not only is Exchange, the service, a vector for attack, but AD-related permissions granted to the Exchange computer account and admins can leave your entire directory vulnerable.
- peblos 6y agoThis is true, although if I look at my old company - they've migrated to Exchange Online and run onprem Exchange servers to support the hybrid environment. But they don't need to publish those servers to the Internet. Many of these orgs should have learned this after [CVE-2020-0688](https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-c...) If it's a hybrid environment, it doesn't need to be exposed. That doesn't solve MS problem of coming up with a better solution though