UCF STIG Viewer Logo

Exchange services must be documented, and unnecessary services must be removed or disabled.


Finding ID Version Rule ID IA Controls Severity
V-259635 EX19-ED-000199 SV-259635r942219_rule Medium
Unneeded but running services offer attackers an enhanced attack profile, and attackers are constantly watching to discover open ports with running services. By analyzing and disabling unneeded services, the associated open ports become unresponsive to outside queries, and servers become more secure as a result. Exchange Server has role-based server deployment to enable protocol path control and logical separation of network traffic types. For example, a server implemented in the Client Access role (i.e., Outlook Web App [OWA]) is configured and tuned as a web server using web protocols. A client access server exposes only web protocols (HTTP/HTTPS), enabling system administrators to optimize the protocol path and disable all services unnecessary for Exchange web services. Similarly, servers created to host mailboxes are dedicated to that task and must operate only the services needed for mailbox hosting. (Exchange servers must also operate some web services but only to the degree that Exchange requires the IIS engine in order to function). Because POP3 and IMAP4 clients are not included in the standard desktop offering, they must be disabled.
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide 2024-01-10


Check Text ( C-63374r942217_chk )
Review the Email Domain Security Plan (EDSP).

Note: Required services will vary between organizations and will vary depending on the role of the individual system. Organizations will develop their own list of services, which will be documented and justified with the ISSO. The site's list will be provided for any security review. Services that are common to multiple systems can be addressed in one document. Exceptions for individual systems should be identified separately by system.

Open a Windows PowerShell and enter the following command:

Get-Service | Where-Object {$_.status -eq 'running'}

Note: The command returns a list of installed services and the status of that service.

If the services required are not documented in the EDSP or undocumented or unnecessary services are running, this is a finding.
Fix Text (F-63282r942218_fix)
Update the EDSP with the services required for the system to function.

Navigate to Administrator Tools >> Services and disable or remove any services that are not required.


in PowerShell:
Stop-Service -Name ;
Set-Service -Name -StartupType Disabled
Stop and disable services that are not required.