STIGQter STIGQter: STIG Summary: Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 30 Jan 2025:

Exchange queue database must reside on a dedicated partition.

DISA Rule

SV-259592r961095_rule

Vulnerability Number

V-259592

Group Title

SRG-APP-000211

Rule Version

EX19-ED-000094

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

It is recommended to follow the instructions found in the following documentation:
https://learn.microsoft.com/en-us/exchange/mail-flow/queues/relocate-queue-database?view=exchserver-2019

Set aside time for maintenance before correcting the issue, as this will affect mail flow through the Edge role on that server.

Open an Exchange Management Shell and use the automated script (shipped with Exchange) to move the queue database and its existing files to the new destination.

The following parameters must be answered to successfully complete the move:

-queueDatabasePath #New destination for the Queue Database. If destination does not exist, the script will create it with the appropriate permissions.
-queueDatabaseLoggingPath #New destination for the Queue Database Logs. If destination does not exist, the script will create it with the appropriate permissions.
-ipFilterDatabasePath #New destination for the IP filtering Database. If the destination does not exist, the script will create it with the appropriate permissions.
-ipFilterDatabaseLoggingPath #New destination for the IP filtering Database Logs. If the destination does not exist, the script will create it with the appropriate permissions.
-temporaryStorage #This will be the path that the script moves the old version of the EdgeTransport.exe.config. The new version will have the updated path.

Note: Always back up the configuration file as CUs will overwrite any added custom configuration.

Check Contents

Open the Exchange Management Shell and run the following command:

Get-Content $exbin\EdgeTransport.exe.config |Select-String "QueueDatabasePath" -SimpleMatch

Example Output:

<add key="QueueDatabasePath" value="F:\Program Files\Microsoft\Exchange
Server\V15\TransportRoles\data\Queue" />

If the path of the Queue Database is in the same volume as the installation of Exchange, this is a finding.

If the path of the Queue Database is on the same volume of existing applications, this is a finding.

Vulnerability Number

V-259592

Documentable

False

Rule Version

EX19-ED-000094

Severity Override Guidance

Open the Exchange Management Shell and run the following command:

Get-Content $exbin\EdgeTransport.exe.config |Select-String "QueueDatabasePath" -SimpleMatch

Example Output:

<add key="QueueDatabasePath" value="F:\Program Files\Microsoft\Exchange
Server\V15\TransportRoles\data\Queue" />

If the path of the Queue Database is in the same volume as the installation of Exchange, this is a finding.

If the path of the Queue Database is on the same volume of existing applications, this is a finding.

Check Content Reference

M

Target Key

5579