STIGQter: STIG Summary: Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The Exchange email diagnostic log level must be set to the lowest level.

DISA Rule

SV-259653r960879_rule

Vulnerability Number

V-259653

Group Title

SRG-APP-000089

Rule Version

EX19-MB-000032

Severity

CAT II

CCI(s)

CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.

Weight

Fix Recommendation

Open the Exchange Management Shell and enter the following command:

Set-EventLogLevel -Identity <'IdentityName\EventlogName'> -Level Lowest

Note: The <IdentityName\EventlogName> value must be in quotes.

Check Contents

Open the Exchange Management Shell and enter the following command:

Get-EventLogLevel

If the Diagnostic of any EventLevel is not set to "Lowest", this is a finding.

Note: Default installation of Exchange has all Event Levels set to Lowest with exception of the following:

MSExchange ADAccess\Topology - Low
MSExchangeADAccess\Validation - Low
MSExchange BackEndRehydration\Configuration - Low
MSExchange BackEndRehydration\Server - 2
MSExchange OAuth\Configuration - Low
MSExchange OAuth\Server - 2
MSExchange RBAC\RBAC - Low
MSExchangeADTopology\Topology - Low

All of these must be set to "Lowest".

The Exchange email diagnostic log level must be set to the lowest level.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key