STIGQter: STIG Summary: Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 24 Jan 2024:

Exchange Internal Receive connectors must not allow anonymous connections.

DISA Rule

SV-228391r879653_rule

Vulnerability Number

V-228391

Group Title

SRG-APP-000261

Rule Version

EX16-MB-000470

Severity

CAT II

CCI(s)

• CCI-001308 - Automatically update spam protection mechanisms on an organization-defined frequency.

Weight

10

Fix Recommendation

Open the Exchange Management Shell and enter the following command:

Set-ReceiveConnector -Identity <'IdentityName'> -PermissionGroups and enter a valid value user group.

Note: The <IdentityName> value must be in single quotes.

Example: Set-ReceiveConnector -Identity <'IdentityName'> -PermissionGroups ExchangeUsers

Repeat the procedures for each Receive connector.

Check Contents

NOTE: In some instances, AnonymousUsers may be necessary for organization-specific operations. In such cases, allowing AnonymousUsers must be paired with restricting to specific lists of servers allowed to access. In addition, the risk must be documented and accepted by the ISSO, ISSM, or AO.
Open the Exchange Management Shell and enter the following command:

Get-ReceiveConnector | Select Name, Identity, PermissionGroups

For each Receive connector, if the value of "PermissionGroups" is "AnonymousUsers" for any receive connector, this is a finding.

Vulnerability Number

V-228391

Documentable

False

Rule Version

EX16-MB-000470

Severity Override Guidance

NOTE: In some instances, AnonymousUsers may be necessary for organization-specific operations. In such cases, allowing AnonymousUsers must be paired with restricting to specific lists of servers allowed to access. In addition, the risk must be documented and accepted by the ISSO, ISSM, or AO.
Open the Exchange Management Shell and enter the following command:

Get-ReceiveConnector | Select Name, Identity, PermissionGroups

For each Receive connector, if the value of "PermissionGroups" is "AnonymousUsers" for any receive connector, this is a finding.

Check Content Reference

M

Target Key

4223