The Microsoft Exchange forms-based authentication service must be disabled.
Identification and Authentication provide the foundation for access control. Access to email services applications in the DoD require authentication using DoD Public Key Infrastructure (PKI) certificates. There are two sections to using form-based authentication the service must be running and the option to use forms-based authentication must be enabled. Forms-based login enables a user to enter a username and password to logon to the system. By disabling the forms-based authentication service malicious users will not have the ability to enter users name and password to access a system.