RPC encryption between Outlook and Exchange server must be enforced.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-71253 | DTOO279 | SV-85877r1_rule | Medium |
| Description |
|---|
| The remote procedure call (RPC) communication channel between an Outlook client computer and an Exchange server is not encrypted. If a malicious individual is able to eavesdrop on the network traffic between Outlook and the server, they might be able to access confidential information. |
| STIG | Date |
|---|---|
| Microsoft Outlook 2016 STIG | 2016-12-02 |
Details
| Check Text ( None ) |
|---|
| None |
| Fix Text (F-46932r1_fix) |
|---|
| Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Account Settings -> Exchange "Enable RPC encryption" to "Enabled". |