STIGQter: STIG Summary: Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 30 Jan 2025:

The Exchange email diagnostic log level must be set to the lowest level.

DISA Rule

SV-259581r960879_rule

Vulnerability Number

V-259581

Group Title

SRG-APP-000089

Rule Version

EX19-ED-000026

Severity

CAT II

CCI(s)

CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.

Weight

Fix Recommendation

Open the Exchange Management Shell and enter the following command:

Set-EventLogLevel -Identity <'IdentityName\EventlogName'> -Level Lowest

Note: The <IdentityName\EventlogName> value must be in quotes.

Check Contents

Open the Exchange Management Shell and enter the following command:

Get-EventLogLevel

If any "EventLogLevel" values returned are not set to "Lowest", this is a finding.

Note: The default installation of Exchange has all Event Levels set to Lowest with exception of the following:

MSExchange ADAccess\Topology - Low
MSExchangeADAccess\Validation - Low
MSExchange BackEndRehydration\Configuration - Low
MSExchange BackEndRehydration\Server - 2
MSExchange OAuth\Configuration - Low
MSExchange OAuth\Server - 2
MSExchange RBAC\RBAC - Low
MSExchangeADTopology\Topology - Low

All of these must be set to Lowest.

The Exchange email diagnostic log level must be set to the lowest level.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key