STIGQter: STIG Summary: Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 24 Jan 2024:

Exchange must provide Mailbox databases in a highly available and redundant configuration.

DISA Rule

SV-228410r879806_rule

Vulnerability Number

V-228410

Group Title

SRG-APP-000435

Rule Version

EX16-MB-000670

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Update the EDSP to specify how Exchange Mailbox databases use redundancy.
Access the Exchange Management Shell and add new Database Availability Groups based upon the EDSP using the following command:

New-DatabaseAvailabilityGroup

See the following documentation for options when creating a DAG:
https://docs.microsoft.com/en-us/exchange/high-availability/manage-ha/create-dags?view=exchserver-2019.

Check Contents

Review the Email Domain Security Plan (EDSP).
Determine if the Exchange Mailbox databases are using redundancy.
Open the Exchange Management Shell.
Enter the following command:
Get-DatabaseAvailabilityGroup <DAGName> | Format-List
If the DAG is not displayed, this is a finding.

Vulnerability Number

V-228410

Documentable

False

Rule Version

EX16-MB-000670

Severity Override Guidance

Review the Email Domain Security Plan (EDSP).
Determine if the Exchange Mailbox databases are using redundancy.
Open the Exchange Management Shell.
Enter the following command:
Get-DatabaseAvailabilityGroup <DAGName> | Format-List
If the DAG is not displayed, this is a finding.

Check Content Reference

M

Target Key

4223