Exchange OWA must use https.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-69775	EX13-CA-000150	SV-84397r2_rule		High

Description
Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.

STIG	Date
MS Exchange 2013 Client Access Server Security Technical Implementation Guide	2019-12-18

Details

Check Text ( C-70225r2_chk )
If the exchange server does not provide OWA services, this check is Not Applicable. If the exchange server does not provide external OWA services, https does not need to be assigned to external URL, it may be blank. Open the Exchange Management Shell and enter the following command: Get-OWAVirtualDirectory \| Select Name, Identity, ExternalUrl, InternalUrl If the value returned is not both ExternalUrl and InternalUrl and these are not set to https://, this is a finding.

Check Text ( C-70225r2_chk )

If the exchange server does not provide OWA services, this check is Not Applicable.
If the exchange server does not provide external OWA services, https does not need to be assigned to external URL, it may be blank.
Open the Exchange Management Shell and enter the following command:

Get-OWAVirtualDirectory | Select Name, Identity, ExternalUrl, InternalUrl

If the value returned is not both ExternalUrl and InternalUrl and these are not set to https://, this is a finding.

Fix Text (F-75987r1_fix)
Open the Exchange Management Shell and enter the following command: Set-OWAVirtualDirectory -Identity '\owa (Default Web Site)' -ExternalUrl 'https://URL' -InternalUrl 'https://URL' Note: The \owa (default web site) value must be in quotes.