CIS Microsoft Exchange Server 2019 Benchmark
Secure configuration guidelines for Microsoft Exchange Server 2019
v2.0.0 January 2025Overview
▶This CIS Benchmark provides prescriptive guidance for establishing a secure configuration posture for Microsoft Exchange Server 2019. Recommendations cover transport configuration, client access, mailbox security, permissions and RBAC, logging and auditing, and server hardening.
| Section | Area | Focus |
|---|---|---|
| 1 | Transport | SMTP, message hygiene |
| 2 | Client Access | OWA, ActiveSync, MAPI |
| 3 | Mailbox | Audit, retention, sharing |
| 4 | Permissions | RBAC, delegate access |
| 5 | Logging | Admin audit, tracking |
| 6 | Hardening | TLS, patching, services |
Profile Definitions
▶| Profile | Description | Intended Use |
|---|---|---|
| L1 | Level 1 — Standard | Essential security for all Microsoft Exchange Server 2019 deployments; minimal performance impact. |
| L2 | Level 2 — Hardened | Advanced hardening for PCI-DSS, HIPAA, or high-security environments. |
1 — Transport Configuration
▶1.1 SMTP Security
▶This recommendation ensures that TLS Is Required for SMTP Connectors on the Microsoft Exchange Server 2019 mail server. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.
Without this enforcement, the Microsoft Exchange Server 2019 mail server may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.
Open Exchange Management Shell and verify that TLS Is Required for SMTP Connectors:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure TLS Is Required for SMTP Connectors:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that SMTP Banner Does Not Reveal Version Information on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that SMTP Banner Does Not Reveal Version Information:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure SMTP Banner Does Not Reveal Version Information:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Anonymous Relay Is Disabled on Receive Connectors on the Microsoft Exchange Server 2019 mail server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Microsoft Exchange Server 2019 mail server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Open Exchange Management Shell and verify that Anonymous Relay Is Disabled on Receive Connectors:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Anonymous Relay Is Disabled on Receive Connectors:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This setting ensures that External Sender Configuration Is Restricted on the Microsoft Exchange Server 2019 mail server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Exchange Server 2019 mail server is essential for defense in depth.
Open Exchange Management Shell and verify that External Sender Configuration Is Restricted:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure External Sender Configuration Is Restricted:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that STARTTLS Domain Security Is Configured on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that STARTTLS Domain Security Is Configured:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure STARTTLS Domain Security Is Configured:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
1.2 Message Hygiene
▶This recommendation verifies that Anti-Spam Agents Are Configured on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Anti-Spam Agents Are Configured:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Anti-Spam Agents Are Configured:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Sender Filtering Is Enabled on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Sender Filtering Is Enabled:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Sender Filtering Is Enabled:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Recipient Filtering Is Enabled on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Recipient Filtering Is Enabled:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Recipient Filtering Is Enabled:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Maximum Message Size Limits Are Configured on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Maximum Message Size Limits Are Configured:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Maximum Message Size Limits Are Configured:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
2 — Client Access
▶2.1 Outlook Web App
▶This recommendation verifies that OWA Uses Forms-Based Authentication on the Microsoft Exchange Server 2019 mail server. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Exchange Server 2019 mail server uses the correct component aligns with industry best practices and standards.
Open Exchange Management Shell and verify that OWA Uses Forms-Based Authentication:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure OWA Uses Forms-Based Authentication:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation ensures that OWA Requires TLS on the Microsoft Exchange Server 2019 mail server. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.
Without this enforcement, the Microsoft Exchange Server 2019 mail server may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.
Open Exchange Management Shell and verify that OWA Requires TLS:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure OWA Requires TLS:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that OWA External URL Is Configured Correctly on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that OWA External URL Is Configured Correctly:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure OWA External URL Is Configured Correctly:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This setting ensures that OWA File Access Is Restricted on the Microsoft Exchange Server 2019 mail server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Exchange Server 2019 mail server is essential for defense in depth.
Open Exchange Management Shell and verify that OWA File Access Is Restricted:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure OWA File Access Is Restricted:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
2.2 ActiveSync & MAPI
▶This recommendation verifies that ActiveSync Device Policies Are Configured on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that ActiveSync Device Policies Are Configured:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure ActiveSync Device Policies Are Configured:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation ensures that ActiveSync Requires Device Encryption on the Microsoft Exchange Server 2019 mail server. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.
Without this enforcement, the Microsoft Exchange Server 2019 mail server may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.
Open Exchange Management Shell and verify that ActiveSync Requires Device Encryption:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure ActiveSync Requires Device Encryption:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that MAPI Over HTTP Is Used Instead of RPC/HTTP on the Microsoft Exchange Server 2019 mail server. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Exchange Server 2019 mail server uses the correct component aligns with industry best practices and standards.
Open Exchange Management Shell and verify that MAPI Over HTTP Is Used Instead of RPC/HTTP:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure MAPI Over HTTP Is Used Instead of RPC/HTTP:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Outlook Anywhere Uses NTLM or Negotiate Authentication on the Microsoft Exchange Server 2019 mail server. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Exchange Server 2019 mail server uses the correct component aligns with industry best practices and standards.
Open Exchange Management Shell and verify that Outlook Anywhere Uses NTLM or Negotiate Authentication:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Outlook Anywhere Uses NTLM or Negotiate Authentication:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
3 — Mailbox Security
▶3.1 Mailbox Policies
▶This recommendation verifies that Mailbox Audit Logging Is Enabled for All Mailboxes on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Mailbox Audit Logging Is Enabled for All Mailboxes:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Mailbox Audit Logging Is Enabled for All Mailboxes:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Retention Policies Are Configured on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Retention Policies Are Configured:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Retention Policies Are Configured:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Unified Messaging Is Disabled If Not Required on the Microsoft Exchange Server 2019 mail server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Microsoft Exchange Server 2019 mail server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Open Exchange Management Shell and verify that Unified Messaging Is Disabled If Not Required:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Unified Messaging Is Disabled If Not Required:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Litigation Hold Is Configured for Compliance on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Litigation Hold Is Configured for Compliance:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Litigation Hold Is Configured for Compliance:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
3.2 Public Folders & Sharing
▶This setting ensures that Public Folder Access Is Restricted on the Microsoft Exchange Server 2019 mail server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Exchange Server 2019 mail server is essential for defense in depth.
Open Exchange Management Shell and verify that Public Folder Access Is Restricted:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Public Folder Access Is Restricted:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that External Sharing Policies Are Configured on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that External Sharing Policies Are Configured:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure External Sharing Policies Are Configured:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This setting ensures that Calendar Sharing Is Restricted to Internal Users on the Microsoft Exchange Server 2019 mail server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Exchange Server 2019 mail server is essential for defense in depth.
Open Exchange Management Shell and verify that Calendar Sharing Is Restricted to Internal Users:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Calendar Sharing Is Restricted to Internal Users:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
4 — Permissions & RBAC
▶4.1 Administrative Permissions
▶This setting ensures that Organization Management Role Group Is Minimized on the Microsoft Exchange Server 2019 mail server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Exchange Server 2019 mail server is essential for defense in depth.
Open Exchange Management Shell and verify that Organization Management Role Group Is Minimized:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Organization Management Role Group Is Minimized:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This setting ensures that Discovery Management Role Group Is Restricted on the Microsoft Exchange Server 2019 mail server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Exchange Server 2019 mail server is essential for defense in depth.
Open Exchange Management Shell and verify that Discovery Management Role Group Is Restricted:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Discovery Management Role Group Is Restricted:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Custom RBAC Roles Follow Least Privilege on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Custom RBAC Roles Follow Least Privilege:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Custom RBAC Roles Follow Least Privilege:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Split Permissions Model Is Configured on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Split Permissions Model Is Configured:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Split Permissions Model Is Configured:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
4.2 Delegate Access
▶This recommendation verifies that Send-As Permissions Are Audited on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Send-As Permissions Are Audited:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Send-As Permissions Are Audited:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Full-Access Permissions Are Audited on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Full-Access Permissions Are Audited:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Full-Access Permissions Are Audited:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Send-on-Behalf Permissions Are Reviewed on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Send-on-Behalf Permissions Are Reviewed:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Send-on-Behalf Permissions Are Reviewed:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
5 — Logging & Auditing
▶5.1 Exchange Logging
▶This recommendation verifies that Administrator Audit Logging Is Enabled on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Administrator Audit Logging Is Enabled:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Administrator Audit Logging Is Enabled:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Message Tracking Is Enabled on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Message Tracking Is Enabled:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Message Tracking Is Enabled:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Protocol Logging Is Enabled on Connectors on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Protocol Logging Is Enabled on Connectors:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Protocol Logging Is Enabled on Connectors:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that IIS Logging Is Configured for Exchange Virtual Directories on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that IIS Logging Is Configured for Exchange Virtual Directories:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure IIS Logging Is Configured for Exchange Virtual Directories:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
5.2 Audit Retention
▶This recommendation verifies that Audit Log Aging Limit Is Set to 90 Days or More on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Audit Log Aging Limit Is Set to 90 Days or More:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Audit Log Aging Limit Is Set to 90 Days or More:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Mailbox Audit Log Age Limit Is Set to 90 Days or More on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Mailbox Audit Log Age Limit Is Set to 90 Days or More:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Mailbox Audit Log Age Limit Is Set to 90 Days or More:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Logs Are Forwarded to SIEM on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Logs Are Forwarded to SIEM:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Logs Are Forwarded to SIEM:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
6 — Server Hardening
▶6.1 TLS & Certificate Management
▶This recommendation verifies that TLS 1.2 Is the Minimum for All Services on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that TLS 1.2 Is the Minimum for All Services:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure TLS 1.2 Is the Minimum for All Services:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Self-Signed Certificates Are Not Used in Production on the Microsoft Exchange Server 2019 mail server. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Microsoft Exchange Server 2019 mail server uses the correct component aligns with industry best practices and standards.
Open Exchange Management Shell and verify that Self-Signed Certificates Are Not Used in Production:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Self-Signed Certificates Are Not Used in Production:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Certificate Expiration Is Monitored on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Certificate Expiration Is Monitored:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Certificate Expiration Is Monitored:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
6.2 Exchange Services
▶This recommendation verifies that Unnecessary Exchange Services Are Disabled on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Unnecessary Exchange Services Are Disabled:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Unnecessary Exchange Services Are Disabled:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Exchange Is Patched with Latest Cumulative Update on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Exchange Is Patched with Latest Cumulative Update:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Exchange Is Patched with Latest Cumulative Update:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This recommendation verifies that Extended Protection Is Enabled on the Microsoft Exchange Server 2019 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Microsoft Exchange Server 2019 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Open Exchange Management Shell and verify that Extended Protection Is Enabled:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure Extended Protection Is Enabled:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value
This setting ensures that PowerShell Remoting Is Restricted on the Microsoft Exchange Server 2019 mail server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Microsoft Exchange Server 2019 mail server is essential for defense in depth.
Open Exchange Management Shell and verify that PowerShell Remoting Is Restricted:
Get-TransportConfig | Format-List Get-ReceiveConnector | Format-List
In Exchange Management Shell, configure PowerShell Remoting Is Restricted:
Set-TransportConfig -Parameter Value Set-ReceiveConnector -Identity '...' -Parameter Value