UCF STIG Viewer Logo

Exchange must have Administrator audit logging enabled.


Overview

Finding ID Version Rule ID IA Controls Severity
V-207267 EX13-MB-000005 SV-207267r615936_rule Medium
Description
Unauthorized or malicious data changes can compromise the integrity and usefulness of the data. Automated attacks or malicious users with elevated privileges have the ability to effect change using the same mechanisms as email administrators. Auditing changes to access mechanisms not only supports accountability and nonrepudiation for those authorized to define the environment but also enables investigation of changes made by others who may not be authorized. Note: This administrator auditing feature audits all exchange changes regardless of the users' assigned role or permissions.
STIG Date
Microsoft Exchange 2013 Mailbox Server Security Technical Implementation Guide 2021-12-16

Details

Check Text ( C-7525r393314_chk )
Open the Exchange Management Shell and enter the following command:

Get-AdminAuditLogConfig | Select Name, AdminAuditLogEnabled

If the value of AdminAuditLogEnabled is not set to True, this is a finding.
Fix Text (F-7525r393315_fix)
Open the Exchange Management Shell and enter the following command:

Set-AdminAuditLogConfig -AdminAuditLogEnabled $true