“The full scan is expected to take several hours,” CISA notes. The msert.exe application must be triggered manually, and because a full scan can consume most server resources, it should only be run during off-peak periods. MSERT is updated constantly, so each download of the tool is designed to work for only 10 days. Since the original Emergency Directive was issued, Microsoft has released two new software tools to help organizations determine whether their Microsoft Exchange Servers have been compromised.įirst, the Microsoft Safety Scanner, also known as MSERT, was updated to detect signs that a Microsoft Exchange Server installation has been compromised by hackers. While the Emergency Directive and the supplemental direction are provided for servers hosted by or on behalf of federal agencies, CISA encourages state and local governments, critical infrastructure entities, and other private sector organizations to review them as well.

The update recommends new tools and specifies additional requirements for forensic investigations, server hardening, and reporting. A month after a major Microsoft Exchange Server vulnerability made headlines, prompting a high-level response from the Federal government, the Cybersecurity and Infrastructure Security Agency (CISA) has issued supplemental direction related to the threat.

Exchange msert