Microsoft Exchange 2013 Mailbox Server Security Technical Implementation Guide

Version: 2

Updated: 11 Jan 2022

Findings: 70

Findings

V-207267 - Exchange must have Administrator audit logging enabled. (medium)
V-207268 - Exchange Servers must use approved DoD certificates. (medium)
V-207269 - Exchange auto-forwarding email to remote domains must be disabled or restricted. (medium)
V-207270 - Exchange Connectivity logging must be enabled. (medium)
V-207271 - The Exchange Email Diagnostic log level must be set to the lowest level. (medium)
V-207272 - Exchange Audit record parameters must be set. (low)
V-207273 - Exchange Circular Logging must be disabled. (low)
V-207274 - Exchange Email Subject Line logging must be disabled. (medium)
V-207275 - Exchange Message Tracking Logging must be enabled. (medium)
V-207276 - Exchange Queue monitoring must be configured with threshold and action. (medium)
V-207277 - Exchange Send Fatal Errors to Microsoft must be disabled. (medium)
V-207278 - Exchange must protect audit data against unauthorized read access. (medium)
V-207279 - Exchange must not send Customer Experience reports to Microsoft. (medium)
V-207280 - Exchange must protect audit data against unauthorized access. (medium)
V-207281 - Exchange must protect audit data against unauthorized deletion. (medium)
V-207282 - Exchange Audit data must be on separate partitions. (medium)
V-207283 - Exchange Local machine policy must require signed scripts. (medium)
V-207284 - The Exchange IMAP4 service must be disabled. (medium)
V-207285 - The Exchange POP3 service must be disabled. (medium)
V-207286 - Exchange Mailbox databases must reside on a dedicated partition. (medium)
V-207287 - Exchange Internet-facing Send connectors must specify a Smart Host. (medium)
V-207288 - Exchange internal Receive connectors must require encryption. (medium)
V-207289 - Exchange internal Receive connectors must use Domain Security (mutual authentication Transport Layer Security). (medium)
V-207290 - Exchange internal Send connectors must require encryption. (medium)
V-207291 - Exchange Public Folder stores must be retained until backups are complete. (medium)
V-207292 - The Exchange Public Folder database must not be overwritten by a restore. (low)
V-207293 - Exchange Mailboxes must be retained until backups are complete. (medium)
V-207294 - The Exchange Mailbox database must not be overwritten by a restore. (low)
V-207295 - Exchange email forwarding must be restricted. (medium)
V-207296 - Exchange email-forwarding SMTP domains must be restricted. (medium)
V-207297 - Exchange Mail quota settings must not restrict receiving mail. (low)
V-207298 - Exchange Mail Quota settings must not restrict receiving mail. (low)
V-207299 - The Exchange Mail Store storage quota must issue a warning. (low)
V-207300 - Exchange Mailbox Stores must mount at startup. (low)
V-207301 - Exchange Message size restrictions must be controlled on Receive connectors. (low)
V-207302 - Exchange Receive connectors must control the number of recipients per message. (low)
V-207303 - Exchange Receive connectors must be clearly named. (low)
V-207304 - The Exchange Receive Connector Maximum Hop Count must be 60. (low)
V-207305 - Exchange Send connectors must be clearly named. (low)
V-207306 - Exchange Send connectors delivery retries must be controlled. (low)
V-207307 - Exchange Message size restrictions must be controlled on Send connectors. (low)
V-207308 - The Exchange Send connector connections count must be limited. (low)
V-207309 - The Exchange global inbound message size must be controlled. (low)
V-207310 - The Exchange global outbound message size must be controlled. (low)
V-207311 - The Exchange Outbound Connection Limit per Domain Count must be controlled. (low)
V-207312 - The Exchange Outbound Connection Timeout must be 10 minutes or less. (low)
V-207313 - Exchange Internal Receive connectors must not allow anonymous connections. (medium)
V-207314 - Exchange external/Internet-bound automated response messages must be disabled. (medium)
V-207315 - Exchange must have antispam filtering installed. (medium)
V-207316 - Exchange must have antispam filtering enabled. (medium)
V-207317 - Exchange must have antispam filtering configured. (medium)
V-207318 - Exchange must not send automated replies to remote domains. (medium)
V-207319 - Exchange servers must have an approved DoD email-aware virus protection software installed. (high)
V-207320 - The Exchange Global Recipient Count Limit must be set. (low)
V-207321 - The Exchange Receive connector timeout must be limited. (low)
V-207322 - The Exchange Public Store storage quota must be limited. (low)
V-207323 - The Exchange application directory must be protected from unauthorized access. (medium)
V-207324 - An Exchange software baseline copy must exist. (medium)
V-207325 - Exchange software must be monitored for unauthorized changes. (medium)
V-207326 - Exchange services must be documented and unnecessary services must be removed or disabled. (medium)
V-207327 - Exchange Outlook Anywhere (OA) clients must use NTLM authentication to access email. (medium)
V-207328 - The Exchange Email application must not share a partition with another application. (medium)
V-207329 - Exchange must not send delivery reports to remote domains. (medium)
V-207330 - Exchange must not send nondelivery reports to remote domains. (medium)
V-207331 - The Exchange SMTP automated banner response must not reveal server details. (medium)
V-207332 - Exchange must provide Mailbox databases in a highly available and redundant configuration. (medium)
V-207333 - Exchange must have the most current, approved service pack installed. (medium)
V-207334 - Exchange Public Folder Stores must mount at startup. (low)
V-207335 - The applications built-in Malware Agent must be disabled. (medium)
V-207336 - A DoD-approved third party Exchange-aware malicious code protection application must be implemented. (medium)