RPC encryption between Outlook and Exchange server must be enforced.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17615	DTOO279	SV-54052r1_rule		Medium

Description
The remote procedure call (RPC) communication channel between an Outlook client computer and an Exchange server is not encrypted. If a malicious individual is able to eavesdrop on the network traffic between Outlook and the server, they might be able to access confidential information.

STIG	Date
Microsoft Outlook 2013 STIG	2018-09-05

Details

Check Text ( C-47992r1_chk )
Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Account Settings -> Exchange "Enable RPC encryption" is set to "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\15.0\outlook\rpc Criteria: If the value EnableRPCEncryption is REG_DWORD = 1, this is not a finding.

Fix Text (F-46932r1_fix)
Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Account Settings -> Exchange "Enable RPC encryption" to "Enabled".