Global recipient count limit must be set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
Exch-115	Exch-115	Exch-115_rule		Low

Description
The Global Recipient Count limit field is used to control the maximum number of recipients that can be specified in a single message sent from this server. Its primary purpose is to minimize the chance of an internal sender spamming other recipients, since SPAM messages often have a large number of recipients. SPAM prevention can originate from both outside and inside organizations. While inbound SPAM is evaluated as it arrives, controls such as this one help prevent SPAM that might originate inside the organization. The Recipient Count Limit is global to the Exchange implementation. Lower-level refinements are possible; however, in this configuration strategy, setting the value once at the global level ensures a more available system by eliminating potential conflicts among multiple settings. A value of less than or equal to 5000 is probably larger than is needed for most organizations, but is small enough to minimize usefulness to spammers, and is easily handled by Exchange. Selecting the "no limit" radio button for this item is likely to result in abuse. Note: Transport configuration settings apply to the organization/global level of Exchange by checking and setting them at the Hub server the setting will apply to both Hub and Edge roles.

Description

The Global Recipient Count limit field is used to control the maximum number of recipients that can be specified in a single message sent from this server. Its primary purpose is to minimize the chance of an internal sender spamming other recipients, since SPAM messages often have a large number of recipients. SPAM prevention can originate from both outside and inside organizations. While inbound SPAM is evaluated as it arrives, controls such as this one help prevent SPAM that might originate inside the organization. The Recipient Count Limit is global to the Exchange implementation. Lower-level refinements are possible; however, in this configuration strategy, setting the value once at the global level ensures a more available system by eliminating potential conflicts among multiple settings. A value of less than or equal to 5000 is probably larger than is needed for most organizations, but is small enough to minimize usefulness to spammers, and is easily handled by Exchange. Selecting the "no limit" radio button for this item is likely to result in abuse. Note: Transport configuration settings apply to the organization/global level of Exchange by checking and setting them at the Hub server the setting will apply to both Hub and Edge roles.

STIG	Date
Microsoft Exchange 2010 Core Server	2012-05-31

Details

Check Text ( C-_chk )
Obtain the Email Domain Security Plan (EDSP) and locate the value for "Maximum Recipients per Envelope". Open the Exchange Management Shell and enter the following command. Get-TransportConfig \| Select Name, Identity, MaxRecipientEnvelopeLimit If the value of "MaxRecipientEnvelopeLimit" is set to 5000 or less, this is not a finding. If the value of "MaxRecipientEnvelopeLimit" is set to more than 5000, and has signoff and risk acceptance in the EDSP, this is not a finding.

Check Text ( C-_chk )

Obtain the Email Domain Security Plan (EDSP) and locate the value for "Maximum Recipients per Envelope".

Open the Exchange Management Shell and enter the following command.

Get-TransportConfig | Select Name, Identity, MaxRecipientEnvelopeLimit

If the value of "MaxRecipientEnvelopeLimit" is set to 5000 or less, this is not a finding.

If the value of "MaxRecipientEnvelopeLimit" is set to more than 5000, and has signoff and risk acceptance in the EDSP, this is not a finding.

Fix Text (F-_fix)
Open the Exchange Management Shell and enter the following command. Set-TransportConfig -Identity-MaxRecipientEnvelopeLimit 5000 or other value as identified by the EDSP.