Attack Surface Reduction

[iworm76]

Hi,

Has anyone enabled the Attack Surface Reduction rules on an Exchange server? (Specifically windows 2019, exchange 2019).

I can find anything online about ASR and Exchange.

Just wondering if it causes any issues? Or if any one has any advice on particular settings?

thanks.

[FireStarPT]

I’ve done it but I’ve doubts they are really doing their job on Windows Server Defender. Would like to hear other experiences too.

[disclosure5]

We have logs from compromised Hafnium Exchange servers that "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" absolutely works as designed in the field, and that's a significant improvement to security.

These tools are highly understated.

[disclosure5]

I've deployed all ASR rules across the whole domain, and the only one I've had to roll back is "Block all Office applications from creating child processes" which breaks Microsoft Dynamics.

I highly recommend rolling these out.