Exchange must not send auto replies to remote domains.
Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Remote users will not receive automated Out-Of-Office delivery reports. This setting can be used to determine if all the servers in the Organization can send Out-of-Office messages.