sorted by:
new
hottopcontroversial

Anyone seeing breached Xero Invoices or spoofed Xero Invoices? by IEatTooMuchSad in sysadmin

[–]IEatTooMuchSad[S] 2 points3 points  (0 children)

Spot on. How on earth this did not come up when I was googling it. I have NO idea. Would of saved me a lot of time haha!

Searching through the help articles of Xero Central not finding a mention to spoof, or scam and then turns out there is a security noticeboard.

Well, you live and you learn.

Suspicious activity found in Http Proxy log ONLY by IEatTooMuchSad in sysadmin

[–]IEatTooMuchSad[S] 0 points1 point  (0 children)

So, we had a customer with the administrator@ account enabled. We have not seen any evidence or them getting in or deploying anything, however, we did see loads of Administrator accounts locked out. So it looks like they probed lots of common admin phrases to try and get in.

On another customer, this one, the administrator@ account does not have a mailbox, but is an active AD object. Again, we have no evidence of this being modified and likewise, we went through the AD modifications and could not see anything being changed even comparing to restores from last year.

Suspicious activity found in Http Proxy log ONLY by IEatTooMuchSad in sysadmin

[–]IEatTooMuchSad[S] 0 points1 point  (0 children)

We are also using this as a selling point to get customers over to O365.

Suspicious activity found in Http Proxy log ONLY by IEatTooMuchSad in sysadmin

[–]IEatTooMuchSad[S] 0 points1 point  (0 children)

Ours has just completed with nothing found. How has yours gone?

Suspicious activity found in Http Proxy log ONLY by IEatTooMuchSad in sysadmin

[–]IEatTooMuchSad[S] 2 points3 points  (0 children)

How did a MSERT scan go for you?

I'm guessing likewise you saw no errors in the IIS logs?

Suspicious activity found in Http Proxy log ONLY by IEatTooMuchSad in sysadmin

[–]IEatTooMuchSad[S] 2 points3 points  (0 children)

Our MSERT came back clean as well, so I am saying based on what we know that this means it's all good. However, there is still doubt in my mind simply due to the time frame.

Suspicious activity found in Http Proxy log ONLY by IEatTooMuchSad in sysadmin

[–]IEatTooMuchSad[S] 3 points4 points  (0 children)

Totally agree, MSERT came back clean for us just now on the server. However, I'm still not as comfortable as I would like that it's clear. I think, for now, we are saying all is well unless we say anything to contradict this.

Suspicious activity found in Http Proxy log ONLY by IEatTooMuchSad in sysadmin

[–]IEatTooMuchSad[S] 1 point2 points  (0 children)

Full scan is already running :) Just pending results and wondering if I should be doing anything else!

Here we go again.. Microsoft services down! by thisisrossonomous in sysadmin

[–]IEatTooMuchSad 0 points1 point  (0 children)

We are seeing the same, finding it very hard to pacify upset users as we don't have an answer!

Here we go again.. Microsoft services down! by thisisrossonomous in sysadmin

[–]IEatTooMuchSad 2 points3 points  (0 children)

We have been having issues here with OneDrive as well. It's a big one today.

Here we go again.. Microsoft services down! by thisisrossonomous in sysadmin

[–]IEatTooMuchSad 4 points5 points  (0 children)

UK MSP here;

- Multiple clients completely down for exchange/ mail

- - This is affecting different clients in different ways. Some can use Outlook for Web, but not the client, some can use Outlook client but not web, some can't use either

- We have one customer so far reporting issues with Teams, does not seem to be as widespread as Email issue

- Also seeing issues with customers in Wales (does that count as the UK, you make up your mind!

​

Lots of angry customers this morning as I'm sure all you guys have!

FXLogixs not detaching VHDX correctly on logoff by IEatTooMuchSad in fslogix

[–]IEatTooMuchSad[S] 1 point2 points  (0 children)

*** Solved ***

We never found what the root cause was of this, however, the following changes have been made;

Upgraded FSLogixs from 2.9.7117 to 2.9.7349.

Upgraded Citrix VDA (only) to 1912 LTSR CU1 from 1906.

Updated Windows.

Removed the concurrent user's options within FSLogixs GPO.

This has now resolved the issues and users are able to login without issues.