STIGQter: STIG Summary: Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Exchange must provide mailbox databases in a highly available and redundant configuration.

DISA Rule

SV-259709r961620_rule

Vulnerability Number

V-259709

Group Title

SRG-APP-000435

Rule Version

EX19-MB-000234

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Update the EDSP to specify how Exchange Mailbox databases use redundancy.

Add two or more Mailbox servers to the database availability group.

Add a database copy to one or more member servers within the database availability group.

Check Contents

Review the Email Domain Security Plan (EDSP).

Determine if a Database Availability Group exists.
From Exchange Admin Center:
1. In the pane on the left, navigate to "servers".
2. In the pane on the right, navigate to the "database availability groups" tab.
3. Verify a database availability group is configured with member servers.

If two or more member servers are not listed, this is a finding.

From Exchange PowerShell, run the following cmdlet:

Get-DatabaseAvailabilityGroup

If no DatabaseAvailabilityGroup is listed or a Database Availability Group is listed but has no member servers, this is a finding.

Determine if the Exchange Mailbox databases are using redundancy.
From Exchange Admin Center:
1. In the pane on the left, navigate to "servers".
2. In the pane on the right, navigate to the "databases" tab.
3. For each database, check the column "SERVERS WITH COPIES".

Unless specified in the EDSP, if the "SERVERS WITH COPIES" column does not have two or more servers listed, this is a finding.

From Exchange PowerShell, run the following cmdlet:

Get-MailboxDatabaseCopyStatus -Identity <DatabaseName>

Unless specified in the EDSP, if the output of this cmdlet does not show more than one copy, this is a finding.

Vulnerability Number

V-259709

Documentable

False

Rule Version

EX19-MB-000234

Severity Override Guidance

Review the Email Domain Security Plan (EDSP).

Determine if a Database Availability Group exists.
From Exchange Admin Center:
1. In the pane on the left, navigate to "servers".
2. In the pane on the right, navigate to the "database availability groups" tab.
3. Verify a database availability group is configured with member servers.

If two or more member servers are not listed, this is a finding.

From Exchange PowerShell, run the following cmdlet:

Get-DatabaseAvailabilityGroup

If no DatabaseAvailabilityGroup is listed or a Database Availability Group is listed but has no member servers, this is a finding.

Determine if the Exchange Mailbox databases are using redundancy.
From Exchange Admin Center:
1. In the pane on the left, navigate to "servers".
2. In the pane on the right, navigate to the "databases" tab.
3. For each database, check the column "SERVERS WITH COPIES".

Unless specified in the EDSP, if the "SERVERS WITH COPIES" column does not have two or more servers listed, this is a finding.

From Exchange PowerShell, run the following cmdlet:

Get-MailboxDatabaseCopyStatus -Identity <DatabaseName>

Unless specified in the EDSP, if the output of this cmdlet does not show more than one copy, this is a finding.

Check Content Reference

M

Target Key

5580