From 48114b6a519775e5d3d737f393a7684b5124dd7c Mon Sep 17 00:00:00 2001 From: Lukas Sassl Date: Wed, 29 Mar 2023 17:30:55 +0200 Subject: [PATCH 1/3] Prepare SearchFolder feature GA --- Security/src/CVE-2023-23397/CVE-2023-23397.ps1 | 7 +++++-- docs/Security/CVE-2023-23397/FAQ.md | 7 ++----- docs/Security/CVE-2023-23397/index.md | 2 ++ 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/Security/src/CVE-2023-23397/CVE-2023-23397.ps1 b/Security/src/CVE-2023-23397/CVE-2023-23397.ps1 index 3dd24cd8dc..4eed37e550 100644 --- a/Security/src/CVE-2023-23397/CVE-2023-23397.ps1 +++ b/Security/src/CVE-2023-23397/CVE-2023-23397.ps1 @@ -770,12 +770,15 @@ begin { ($UseSearchFolders -eq $false) -and ($SearchFolderCleanup -eq $false)) { $newSearchFeatureWording = "Did you know?" + - "`nWe've introduced a new asynchronous search feature (preview) in this version to improve the performance of the search." + - "`nIt's disabled by default and can be enabled by using the following parameters:" + + "`nThe new asynchronous search fature is now general available (GA)!" + + "`nWe recommend using it because the search performance is significantly increased." + + "`nYou can enable it by using the the following parameters:" + "`n" + "`nUseSearchFolders: Enable deep-traversal SearchFolders search to significantly improve performance" + "`nSearchFolderCleanup: Clean up any SearchFolders left behind by the -UseSearchFolders switch" + "`n" + + "`nThis version of the script also supports Certificate Based Authentication (CBA)" + + "`n" + "`nMore information: https://aka.ms/CVE-2023-23397ScriptDocFAQ" Write-Host "" Write-Host $newSearchFeatureWording -ForegroundColor Cyan diff --git a/docs/Security/CVE-2023-23397/FAQ.md b/docs/Security/CVE-2023-23397/FAQ.md index 3af81158f6..9dbd39ba49 100644 --- a/docs/Security/CVE-2023-23397/FAQ.md +++ b/docs/Security/CVE-2023-23397/FAQ.md @@ -1,18 +1,15 @@ # CVE-2023-23397 Frequently Asked Questions -## What is the -UseSearchFolders preview feature? +## What is the -UseSearchFolders feature? This feature changes the way Audit mode works to be dramatically faster in most environments. The original approach searches folders synchronously one by one. When using the new switch, we perform two passes. In the first pass, we create a search folder that searches the whole mailbox. In the second pass, we collect the results. This often reduces the time to run the Audit mode by 80% or more. -This feature is still considered a preview. The old behavior can be used by simply not including the --UseSearchFolders parameter. - To use the new feature, use the same syntax as before, but add -UseSearchFolders. For example: -**NOTE:** Connect to EXO with [Exchange Online PowerShell session](https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps) +**NOTE:** Connect to EXO with [Exchange Online PowerShell session](https://learn.microsoft.com/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps) ```powershell Get-EXOMailbox -ResultSize Unlimited | .\CVE-2023-23397.ps1 -Environment Online -UseSearchFolders diff --git a/docs/Security/CVE-2023-23397/index.md b/docs/Security/CVE-2023-23397/index.md index c7c6c76dea..8cfa9f334d 100644 --- a/docs/Security/CVE-2023-23397/index.md +++ b/docs/Security/CVE-2023-23397/index.md @@ -102,6 +102,8 @@ ScriptUpdateOnly | This optional parameter allows you to only update the script SkipVersionCheck | This optional parameter allows you to skip the automatic version check and script update. IgnoreCertificateMismatch | This optional parameter lets you ignore TLS certificate mismatch errors. Credential | This optional parameter lets you pass admin credentials when running on Exchange Server. +UseSearchFolders | This parameter causes the script to use deep-traversal search folders, significantly improving performance. +SearchFolderCleanup | This parameter cleans up any search folders left behind by the asynchronous search feature. TimeoutSeconds | This optional parameter specifies the timeout on the EWS ExchangeService object. The default is 300 seconds (5 minutes). #### Set Exchange Online Cloud Specific values: From f50312b6076be9e16fa8ed796142e44b8608591a Mon Sep 17 00:00:00 2001 From: Lukas Sassl Date: Wed, 29 Mar 2023 17:36:24 +0200 Subject: [PATCH 2/3] Typo fixed --- Security/src/CVE-2023-23397/CVE-2023-23397.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Security/src/CVE-2023-23397/CVE-2023-23397.ps1 b/Security/src/CVE-2023-23397/CVE-2023-23397.ps1 index 4eed37e550..05c298bcac 100644 --- a/Security/src/CVE-2023-23397/CVE-2023-23397.ps1 +++ b/Security/src/CVE-2023-23397/CVE-2023-23397.ps1 @@ -770,7 +770,7 @@ begin { ($UseSearchFolders -eq $false) -and ($SearchFolderCleanup -eq $false)) { $newSearchFeatureWording = "Did you know?" + - "`nThe new asynchronous search fature is now general available (GA)!" + + "`nThe new asynchronous search feature is now general available (GA)!" + "`nWe recommend using it because the search performance is significantly increased." + "`nYou can enable it by using the the following parameters:" + "`n" + From c508e106dc9024e1ee3c0fefafa4ad7f22eacb12 Mon Sep 17 00:00:00 2001 From: Lukas Sassl Date: Thu, 30 Mar 2023 09:05:42 +0200 Subject: [PATCH 3/3] Parameter description updated as per review --- docs/Security/CVE-2023-23397/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/Security/CVE-2023-23397/index.md b/docs/Security/CVE-2023-23397/index.md index 8cfa9f334d..883cf0509d 100644 --- a/docs/Security/CVE-2023-23397/index.md +++ b/docs/Security/CVE-2023-23397/index.md @@ -103,7 +103,7 @@ SkipVersionCheck | This optional parameter allows you to skip the automatic vers IgnoreCertificateMismatch | This optional parameter lets you ignore TLS certificate mismatch errors. Credential | This optional parameter lets you pass admin credentials when running on Exchange Server. UseSearchFolders | This parameter causes the script to use deep-traversal search folders, significantly improving performance. -SearchFolderCleanup | This parameter cleans up any search folders left behind by the asynchronous search feature. +SearchFolderCleanup | This parameter cleans up any search folders left behind by the asynchronous search feature. It must be used together with the `UseSearchFolders` parameter. TimeoutSeconds | This optional parameter specifies the timeout on the EWS ExchangeService object. The default is 300 seconds (5 minutes). #### Set Exchange Online Cloud Specific values: