Exchange must not send non-delivery reports to remote domains.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| Exch-ED-221 | Exch-ED-221 | Exch-ED-221_rule | Medium |
| Description |
|---|
| Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Ensure that non-delivery reports to remote domains are disabled. Before enabling this setting first configure a remote domain using the EMC or the New-RemoteDomain cmdlet. |
| STIG | Date |
|---|---|
| Microsoft Exchange 2010 Edge Transport Server Role | 2012-05-31 |
Details
| Check Text ( C-_chk ) |
|---|
| Open the Exchange Management Shell and enter the following command. Get-RemoteDomain | select identity, NDREnabled If the value of "NDREnabled" is not set to "False", this is a finding. |
| Fix Text (F-_fix) |
|---|
| Open the Exchange Management Shell and enter the following command. Set-RemoteDomain -Identity <'RemoteDomainName'> -NDREnabled $false |