Try our new Certificate Revocation List Check Tool
CRLcheck.exe is a tool developed to verify digital signatures of executable files. It collects files from known paths on your client, checks their signature, and checks Certificate Revocation Lists (CRL) and OCSP download. This helps avoid delays in launching files.

M365/Exchange Hybrid OAuth Testing command, OAuth-Cert out-of-sync 4001, IIS VDIR OAuth wrong

www.butsch.ch Resolve and find OAuth problem in Exchange Hybrid Setup Environment Short Understanding OAuth: OAuth (Open Authorization) is an industry-standard protocol that enables secure authorization for third-party applications without the need to disclose user credentials. It allows users to grant limited access to their resources on one site to another site, without sharing their credentials. […]

Outlook.exe, delay in receive and sending E-Mail in cached mode how to solve with GPO

    In the OLD KB-Nummer: 982697 MS explains……. (Now MS Learn…) The default Behavior for downloading shared folders can be modified using Group Policy and registry settings. Some of these policies and registry values may have improved the performance of shared folders in earlier versions of Outlook or when the shared folders were located […]

MS SRV Disable IPv6 the correct way CVE-2024-38063

Recommendation 16.08.2024 for CVE-2024-38063 and IPV6 There is a patch from 2008-2022+ Servers so use it See following LINK on how to import the older OS patches into WSUS CVE-2024-38063, CVSS 9.8, import free 2008/R2 + 2012R2 into WSUS – www.butsch.ch https://www.butsch.ch/post/cve-2024-38063-cvss-9-8-how-to-import-the-free-2008-2008r2-patch-into-wsus/ If you can’t patch then as least options CAREFULLY consider disabling IPV6 the […]

Crowdstrike Falcon Sensor, Azure VM Repair paths

The procedures in this article describe methods you can use to attach an encrypted OS disk to a repair VM and then unlock that disk. After the disk is unlocked, you can repair it. As a final step, you can replae the OS disk on the original VM with this newly repaired version. Microsoft has […]

Crowdstrike Falcon, BSOD, VMWARE Server Recovery DEU

Es gibt einige Server, bei denen Sie nicht in den Wiederherstellungsmodus oder den abgesicherten Modus booten können. Wenn das Volume nicht verschlüsselt ist, haben Sie eine Möglichkeit, die fehlerhafte CrowdStrike-Def-Datei von der Festplatte zu löschen. Basisartikel von uns: https://www.butsch.ch/post/19-07-2024-bsod-blue-screen-crowdstrike/ Crowdstrike Falcon Sensor, Azure VM Repair paths   Um eine virtuelle Festplatte in einer VMware-Umgebung von […]

Falcon Sensor, Bluescreen of Death Vmware workaround if you can’t boot into recovery

  Workaround Server / Vmware affected with NO Recovery Option and not encrypted:   There are some server where you can’t boot into recovery or safe boot. If the volume is not encrypted you have one way to delete the faulty crowdstrike def file from the disk. Base article: 19.07.2024 BSOD Blue screen Crowdstrike – […]

19.07.2024 BSOD Blue screen Crowdstrike

The falcon has crashed BSOD blue screen of death on clients and server OS Red Teams and Hackers > see where you have brought us?   https://www.trellix.com/about/why-trellix/vscrowdstrike/ The latest CrowdStrike Falcon Sensor update is causing a widespread issue resulting in a Blue Screen of Death (BSOD) boot loop globally. It’s a security professional’s worst nightmare […]

Proxy settings der Cryptography API bei Zertifikatswiderrufslisten (CRL) von einem CRL-Verteilungspunkt

  Dieser Artikel zielt darauf ab, den Prozess zu erläutern, den die Crypto API durchläuft, um erfolgreich eine HTTP-basierte URL für den CRL-Verteilungspunkt herunterzuladen. Er dient auch der Fehlerbehebung in Situationen, die mit der Netzwerkrückgewinnung von CRLs verbunden sind. Zusätzlich wird unser kostenloses Tool, crlcheck.exe, erwähnt, das dazu beitragen soll, komplexe Probleme effektiver zu lösen. […]

13.06.2024 False-Postive with ENS 10.7, AMCORE 5554 on Windows Defender AM_Delta_Patch Server 2019 German

  Trellix ENS 10.7 deletes Windows Defender Update which come from WSUS-Server on German Server 2019 We just did see a false positive on Windows Defender Updates we provide via WSUS with autoaprove on a Windows Server 2019 German with Trellix ENS 10.7 and AMCORE 5554. The file was deleted from C:\Windows\SoftwareDistribution\Download\ Microsoft affected file: […]