UCF STIG Viewer Logo

Exchange 2010 Mailbox Server STIG


Overview

Date Finding Count (14)
2013-12-11 CAT I (High): 0 CAT II (Med): 14 CAT III (Low): 0
STIG Description
The Microsoft Exchange Server 2010 STIGs cover four of the five roles available with Microsoft Exchange Server 2010. The Email Services Policy STIG must also be reviewed for each site hosting email services. Also, for the Client Access server, the IIS guidance must be reviewed prior to the OWA checks. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.letterkenny.FSO.mbx.stig-customer-support-mailbox@mail.mil.

Available Profiles



Findings (MAC III - Administrative Sensitive)

Finding ID Severity Title
V-33629 Medium The current, approved service pack must be installed.
V-33620 Medium Email software must be monitored for change on INFOCON frequency schedule.
V-33621 Medium Exchange software baseline copy must exist.
V-33623 Medium Services must be documented and unnecessary services must be removed or disabled.
V-33625 Medium Email application must not share a partition with another application.
V-33626 Medium Servers must use approved DoD certificates.
V-33616 Medium Exchange must not send Customer Experience reports to Microsoft.
V-33611 Medium Audit data must be protected against unauthorized access.
V-33613 Medium Exchange application directory must be protected from unauthorized access.
V-33632 Medium Local machine policy must require signed scripts.
V-33606 Medium Email Diagnostic log level must be set to lowest level.
V-33608 Medium The Send Fatal Errors to Microsoft must be disabled.
V-33619 Medium Queue monitoring must be configured with threshold and action.
V-33618 Medium Audit data must be on separate partitions.