CVE described on MSRC. Remediated using ECM (aka SCCM) Config Items:

• See the remediation and Discovery scripts in repo.
• Config Item does a boolean $false check for compliance.

Remediation

In production, we found the need to remediate purge copies other than ClientAccessible ones; we've seen Backup and DataVolumeRollback types that couldn't be deleted. Unfortunately, vssadmin cleary states that "only shadow copies that have the ClientAccessible type can be deleted." In order to purge them anyway, we needed to shrink the size of the storage down to the smallest amount allowed (320MB); this will cause Windows to purge the oversized shadow copy. We then bring it back to a normal/unbounded size.

Contributing

Issues

All features and bug reports must be tracked as GitHub Issues before any work begins. Issues are the authoritative record of intent — PRs without a corresponding issue will not be merged.

Pull Requests

All changes require a PR. Direct commits to the default branch are not permitted.

PR requirements:

• Reference the issue in the PR description (Closes #N or Ref #N)
• Include a CHANGELOG.md entry — one entry per issue, referencing the issue number for full context
• All code review comments must be acknowledged and addressed before merge — no unresolved items at merge time