Exchange OWA must use https.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-69775 | EX13-CA-000150 | SV-84397r1_rule | High |
| Description |
|---|
| Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered. |
| STIG | Date |
|---|---|
| MS Exchange 2013 Client Access Server Security Technical Implementation Guide | 2019-01-02 |
Details
| Check Text ( C-70225r1_chk ) |
|---|
| Open the Exchange Management Shell and enter the following command: Get-OWAVirtualDirectory | Select Name, Identity, ExternalUrl, InternalUrl If the value returned is not both ExternalUrl and InternalUrl and these are not set to https://, this is a finding. |
| Fix Text (F-75987r1_fix) |
|---|
| Open the Exchange Management Shell and enter the following command: Set-OWAVirtualDirectory -Identity ' Note: The |