Windows 10: NT AUTHORITY\SYSTEM ‎powershell‎, New-MailboxExportRequest

Hi Community,I have an exch of 2016 Cu22 and Cu23. All are patched with the latest patches on both CU updates. but recently I have seen a mailbox export request visible on my EAC notification bells. I check and surprise. some exploits RAN a command on the power shell to get a pst file. how I protect it. mitigations also applied. but the power shell still running. why and how to become more secure.User:NT AUTHORITY\SYSTEM ‎powershell‎Object modifiedB#979badcf-b2d0-4679-b96a-e88dc28582e3\87df17eb-24e4-4f3d-8343-45227c43db85Cmdlet:New-MailboxExportRequestParameters Parameter:ValueMembers:&n

:)

 

NT Service\TrustedInstaller & NT authority\system

It doesn't log you into another user, you are running cmd.exe under a system process when you use utilman, So anything you then run under cmd.exe is running with the authority of 'NT authority\system'

Kind Regards,

Elise

 

NT Service\TrustedInstaller & NT authority\system

is "NT Service\TrustedInstaller" the same thing as "NT Authority\system"? can you log into "NT Athority\system"?

i understand that "NT Service\TrustedInstaller" is not a user, i under stand that "NT Service\TrustedInstaller" is just trustedinstaller.exe with a temporary user ID.

i know that i cannot log into "NT Service\TrustedInstaller".

when i say "log into" i mean: "go into the user account and open file explorer's desktop and make it act like a normal user"

 

NT AUTHORITY/SYSTEM shutdown

How do I removed this shutdown initiated by NT AUTHORITY/SYSTEM on windows 10?. It keeps showing up on my PC.