Receive Connectors must control the number of recipients per message.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-33572	Exch-2-727	SV-43992r2_rule	ECSC-1	Low

Description
Email system availability depends in part on best practices strategies for setting tuning configurations. This configuration controls the maximum number of recipients who will receive a copy of a message at one time. This tunable value is related to throughput capacity and can enable the ability to optimize message delivery. Note: There are two types of default Receive Connecters: Client Servername: This Receive connector accepts SMTP connections from all non-MAPI clients, such as POP and IMAP. As POP and IMAP are not authorized for use in DoD, these should not be present. Their default value for MaxRecipientsPerMessage is 200. Default Servername: This Receive connector accepts connections from other Hub Transport servers and any Edge Transport servers. Their default value for MaxRecipientsPerMessage is 5000.

Description

Email system availability depends in part on best practices strategies for setting tuning configurations. This configuration controls the maximum number of recipients who will receive a copy of a message at one time. This tunable value is related to throughput capacity and can enable the ability to optimize message delivery. Note: There are two types of default Receive Connecters: Client Servername: This Receive connector accepts SMTP connections from all non-MAPI clients, such as POP and IMAP. As POP and IMAP are not authorized for use in DoD, these should not be present. Their default value for MaxRecipientsPerMessage is 200. Default Servername: This Receive connector accepts connections from other Hub Transport servers and any Edge Transport servers. Their default value for MaxRecipientsPerMessage is 5000.

STIG	Date
Exchange 2010 Hub Transport Server STIG	2014-03-11

Details

Check Text ( C-41678r2_chk )
Obtain the Email Domain Security Plan (EDSP) and locate the 'Maximum Recipients per Message' value: Open the Exchange Management Shell and enter the following command: Get-ReceiveConnector \| Select Name, Identity, MaxRecipientsPerMessage For each receive connector, evaluate the 'MaxRecipientsPerMessage' value. If the value of 'Maximum Recipients per Message' is set to a value other than 5000, and has signoff and risk acceptance in the EDSP, this is not a finding. If the value of 'MaxRecipientsPerMessage' is not set to 5000, this is a finding.

Check Text ( C-41678r2_chk )

Obtain the Email Domain Security Plan (EDSP) and locate the 'Maximum Recipients per Message' value:

Open the Exchange Management Shell and enter the following command:

Get-ReceiveConnector | Select Name, Identity, MaxRecipientsPerMessage

For each receive connector, evaluate the 'MaxRecipientsPerMessage' value.

If the value of 'Maximum Recipients per Message' is set to a value other than 5000, and has signoff and risk acceptance in the EDSP, this is not a finding.

If the value of 'MaxRecipientsPerMessage' is not set to 5000, this is a finding.

Fix Text (F-37463r2_fix)
Open the Exchange Management Shell and enter the following command: Set-ReceiveConnector -Identity <'ReceiveConnector'> -MaxRecipientsPerMessage 5000 or other value as identified by the EDSP.