# stig_rules

vuln_id: V-221210
rule_id: SV-221210r960963_rule
severity: CAT II
title: Exchange must not send Customer Experience reports to Microsoft.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

  Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 

  Examples of non-essential capabilities include, but are not limited to, advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but cannot be disabled.

  All system errors in Exchange will result in outbound traffic that may be identified by an eavesdropper. For this reason, the "Report Fatal Errors to Microsoft" feature must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-OrganizationConfig -CustomerFeedbackEnabled $false

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-OrganizationConfig | Select Name, Identity, CustomerFeedbackEnabled 

  If the value for "CustomerFeedbackEnabled" is not set to "False", this is a finding.


vuln_id: V-221211
rule_id: SV-221211r960930_rule
severity: CAT II
title: Exchange Audit data must be protected against unauthorized access (read access).
cci: CCI-000162
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive and in need of protection. Audit data available for modification by a malicious user can be altered to conceal malicious activity. Audit data might also provide a means for the malicious user to plan unauthorized activities that exploit weaknesses.
    
  The contents of audit logs are protected against unauthorized access, modification, or deletion. Only authorized auditors and the audit functions should be granted read and write access to audit log data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the authorized groups or users that should have read access to the audit data.

  Restrict any unauthorized groups' or users' read access to the audit logs.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the authorized groups or users that should have read access to the audit data.

  If any group or user has read access to the audit data that is not documented in the EDSP, this is a finding.


vuln_id: V-221212
rule_id: SV-221212r960963_rule
severity: CAT II
title: Exchange Send Fatal Errors to Microsoft must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

  Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 

  Examples of non-essential capabilities include, but are not limited to, advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but cannot be disabled.

  Customer Experience reports in Exchange will result in outbound traffic that may be identified by an eavesdropper. For this reason, the Customer Experience reports to Microsoft must not be sent.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ExchangeServer -Identity <'IdentityName'>  -ErrorReportingEnabled $false

  Note: The <IdentityName> value must be in single quotes.

  Repeat the procedure for each Identity.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ExchangeServer –status | Select Name, Identity, ErrorReportingEnabled

  For each exchange server, if the value of "ErrorReportingEnabled" is not set to "False", this is a finding.


vuln_id: V-221213
rule_id: SV-221213r960933_rule
severity: CAT II
title: Exchange audit data must be protected against unauthorized access for modification.
cci: CCI-000163
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive and in need of protection. Audit data available for modification by a malicious user can be altered to conceal malicious activity. Audit data might also provide a means for the malicious user to plan unauthorized activities that exploit weaknesses.
    
  The contents of audit logs are protected against unauthorized access, modification, or deletion. Only authorized auditors and the audit functions should be granted read and write access to audit log data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the authorized groups or users that should have modify permissions to the audit data.

  Restrict any unauthorized groups' or users' modify permissions for the audit logs.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the authorized groups or users that should have modify permissions to the audit data.

  If any group or user has modify permissions for the audit data that is not documented in the EDSP, this is a finding.


vuln_id: V-221214
rule_id: SV-221214r960936_rule
severity: CAT II
title: Exchange audit data must be protected against unauthorized access for deletion.
cci: CCI-000164
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive and in need of protection. Audit data available for modification by a malicious user can be altered to conceal malicious activity. Audit data might also provide a means for the malicious user to plan unauthorized activities that exploit weaknesses.
    
  The contents of audit logs are protected against unauthorized access, modification, or deletion. Only authorized auditors and the audit functions should be granted read and write access to audit log data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the authorized groups or users that should have delete permissions for the audit data.

  Restrict any unauthorized groups' or users' delete permissions for the audit logs.

check_text:
  Review the Email Domain Security Plan (EDSP). 

  Determine the authorized groups or users that should have delete permissions for the audit data.

  If any group or user has delete permissions for the audit data that is not documented in the EDSP, this is a finding.


vuln_id: V-221215
rule_id: SV-221215r960948_rule
severity: CAT II
title: Exchange audit data must be on separate partitions.
cci: CCI-001348
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive and in need of protection.   

  Successful exploit of an application server vulnerability may well be logged by monitoring or audit processes when it occurs. Writing log and audit data to a separate partition where separate security contexts protect them may offer the ability to protect this information from being modified or removed by the exploit mechanism.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP.

  Configure the audit log location to be on a partition drive separate from the application.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the audit logs' assigned partition.

  Note: By default, the logs are located on the application partition in \Program Files\Microsoft\Exchange Server\V15\Logging\.   

  If the log files are not on a separate partition from the application, this is a finding.


vuln_id: V-221216
rule_id: SV-221216r960954_rule
severity: CAT II
title: The Exchange local machine policy must require signed scripts.
cci: CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Scripts, especially those downloaded from untrusted locations, often provide a way for attackers to infiltrate a system. By setting machine policy to prevent unauthorized script executions, unanticipated system impacts can be avoided.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ExecutionPolicy RemoteSigned

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ExecutionPolicy

  If the value returned is not "RemoteSigned", this is a finding.


vuln_id: V-221217
rule_id: SV-221217r961101_rule
severity: CAT II
title: Exchange Internet-facing Send connectors must specify a Smart Host.
cci: CCI-001178
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>When identifying a "Smart Host" for the email environment, a logical Send connector is the preferred method.

  A Smart Host acts as an Internet-facing concentrator for other email servers. Appropriate hardening can be applied to the Smart Host, rather than at multiple locations throughout the enterprise.

  Failure to identify a Smart Host could default to each email server performing its own lookups (potentially through protective firewalls). Exchange servers should not be Internet facing and should therefore not perform any Smart Host functions. When the Exchange servers are Internet facing, they must be configured to identify the Internet-facing server that is performing the Smart Host function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SendConnector <'IdentityName'> -SmartHosts <'IP Address of Smart Host'> -DNSRoutingEnabled $false   

  Note: The <IdentityName> value must be in single quotes.

  Repeat the procedures for each send connector.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the Internet-facing connectors.

  Open the Exchange Management Shell and enter the following command:

  Get-SendConnector | Select Name, Identity, SmartHosts, DNSRoutingEnabled

  For each send connector, if the value of "SmartHosts" does not return the Smart Host IP Address and the value for "DNSRoutingEnabled" is not set to "False", this is a finding.


vuln_id: V-221218
rule_id: SV-221218r1043178_rule
severity: CAT II
cci: CCI-001184
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Exchange internal Send connectors must use domain security (mutual authentication Transport Layer Security).

description:
  <VulnDiscussion>The Simple Mail Transfer Protocol (SMTP) connector is used by Exchange to send and receive messages from server to server. Several controls work together to provide security between internal servers. This setting controls the authentication method used for communications between servers. With this feature enabled, only servers capable of supporting domain authentication will be able to send and receive mail within the domain.

  The use of secure communication prevents eavesdroppers from reading or modifying communications between mail clients and servers. While sensitive message bodies should be encrypted by the sender at the client, requiring a secure connection from server to server adds protection by encrypting the sender and recipient information that cannot be encrypted by the sender.  

  Individually, channel security and encryption can be compromised by attackers. Used together, email becomes a more difficult target, and security is heightened. Failure to enable this feature gives eavesdroppers an opportunity to read or modify messages between servers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SendConnector <'IdentityName'> -DomainSecureEnabled $true

  Note: The <IdentityName> value must be in single quotes.

  Repeat the procedures for each send connector.

  The following commands can be executed if smarthosts are used:

  Set-SendConnector <'IdentityName'> -RequireTLS $true -DNSRoutingEnabled $False -TlsAuthLevel $DomainValidation

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-SendConnector | Select Name, Identity, DomainSecureEnabled, DNSRoutingEnabled, RequireTLS, TlsAuthLevel 

  For each send connector: 

  If the send connector does not use a smarthost and the value of "DomainSecureEnabled" is not set to "True", this is a finding.

  If the send connector does use a smarthost, "DomainSecureEnabled" will be set to "False".  

  If the send connector does use a smarthost "DNSRoutingEnabled",  "RequireTLS", and "TlsAuthLevel" must be set.

  If the send connector using a smart host has a value for “DNSRoutingEnabled” that is not set to “False”, this is a finding.

  If the send connector using a smarthost has a value for “RequireTLS” that is not set to “True”, this is a finding.

  If the send connector using a smarthost has a value for “TlsAuthLevel” that is not set to “DomainValidation”, this is a finding.


vuln_id: V-221219
rule_id: SV-221219r1043178_rule
severity: CAT II
cci: CCI-001184
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Exchange Internet-facing Receive connectors must offer Transport Layer Security (TLS) before using basic authentication.

description:
  <VulnDiscussion>Sending unencrypted email over the Internet increases the risk that messages can be intercepted or altered. TLS is designed to protect confidentiality and data integrity by encrypting email messages between servers and thereby reducing the risk of eavesdropping, interception, and alteration. This setting forces Exchange to offer TLS before using basic authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -AuthMechanism 'Tls, BasicAuth, BasicAuthRequireTLS'

  Note: The <IdentityName> value must be in single quotes.

  Example only for the Identity: <ServerName>\Frontend <ServerName>

  Repeat the procedure for each receive connector.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, AuthMechanism

  For each receive connector, if the value of "AuthMechanism" is not set to "Tls, BasicAuth, BasicAuthRequireTLS", this is a finding.


vuln_id: V-221220
rule_id: SV-221220r961155_rule
severity: CAT II
title: Exchange Outbound Connection Timeout must be 10 minutes or less.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. This configuration controls the number of idle minutes before the connection is dropped. It works in conjunction with the Maximum Outbound Connections Count setting.

  Connections, once established, may incur delays in message transfer. The default of 10 minutes is a reasonable window in which to resume activities without maintaining idle connections for excessive intervals. If the timeout period is too long, idle connections may be maintained for unnecessarily long time periods, preventing new connections from being established. Sluggish connectivity increases the risk of lost data. A value of 10 or less is optimal.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the Connection Timeout value.

  Open the Exchange Management Shell and enter the following command:

  Set-SendConnector -Identity <'IdentityName'> -ConnectionInactivityTimeOut 00:10:00

  Note: The <IdentityName> value must be in single quotes.

  or

  The value as identified by the EDSP that has obtained a signoff with risk acceptance.

  Repeat the procedure for each send connector.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the Connection Timeout value.  

  Open the Exchange Management Shell and enter the following command:

  Get-SendConnector | Select Name, Identity, ConnectionInactivityTimeOut 

  For each send connector, if the value of "ConnectionInactivityTimeOut" is not set to "00:10:00", this is a finding.

  or

  If "ConnectionInactivityTimeOut" is set to other than "00:10:00" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-221221
rule_id: SV-221221r961155_rule
severity: CAT II
title: Exchange Outbound Connection Limit per Domain Count must be controlled.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. This configuration controls the maximum number of simultaneous outbound connections from a domain and works in conjunction with the Maximum Outbound Connections Count setting as a delivery tuning mechanism. If the limit is too low, connections may be dropped. If the limit is too high, some domains may use a disproportionate resource share, denying access to other domains. Appropriate tuning reduces the risk of data delay or loss. 

  By default, a limit of 20 simultaneous outbound connections from a domain should be sufficient. The value may be adjusted if justified by local site conditions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the value for Maximum Domain Connections.

  Open the Exchange Management Shell and enter the following command:

  Set-TransportService -Identity <'IdentityName'> -MaxPerDomainOutboundConnections 20

  Note: The <IdentityName> value must be in single quotes.

  or

  The value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the value for Maximum Domain Connections.

  Open the Exchange Management Shell and enter the following command:

  Get-TransportService | Select Name, Identity, MaxPerDomainOutboundConnections

  If the value of "MaxPerDomainOutboundConnections" is not set to "20", this is a finding.

  or

  If the value of "MaxPerDomainOutboundConnections" is set to a value other than "20" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-221222
rule_id: SV-221222r961155_rule
severity: CAT III
title: Exchange Send connector connections count must be limited.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This setting controls the maximum number of simultaneous outbound connections allowed for a given SMTP Connector and can be used to throttle the SMTP service if resource constraints warrant it. If the limit is too low, connections may be dropped. If the limit is too high, some domains may use a disproportionate resource share, denying access to other domains. Appropriate tuning reduces the risk of data delay or loss.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the value for SMTP Server Maximum Outbound Connections.

  Open the Exchange Management Shell and enter the following command:

  Set-TransportService -Identity <'IdentityName'> -MaxOutboundConnections 1000

  Note: The <IdentityName> value must be in single quotes.

  or

  The value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the value for SMTP Server Maximum Outbound Connections.

  Open the Exchange Management Shell and enter the following command:

  Get-TransportService | Select Name, Identity, MaxOutboundConnections

  If the value of "MaxOutboundConnections" is not set to "1000", this is a finding.

  or

  If the value of "MaxOutboundConnections" is set to a value other than "1000" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-221223
rule_id: SV-221223r961155_rule
severity: CAT III
title: Exchange message size restrictions must be controlled on Send connectors.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. For message size restrictions, multiple places exist to set or override inbound or outbound message size. Failure to control the configuration strategy can result in loss of data or system availability. 

  This setting enables the administrator to control the maximum message size on a Send connector. Using connectors to control size limits may necessitate applying message size limitations in multiple places, with the potential of introducing conflicts and impediments in the mail flow. Changing this setting at the connector overrides the global one. Therefore, if operational needs require it, the connector value may be set lower than the global value with the rationale documented in the EDSP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the maximum message send size.

  Open the Exchange Management Shell and enter the following command:

  Set-SendConnector -Identity <'IdentityName'> -MaxMessageSize <MaxSendSize>

  Note: The <IdentityName> value must be in single quotes.

  or

  The value as identified by the EDSP that has obtained a signoff with risk acceptance.

  Repeat the procedure for each send connector.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the maximum message send size.

  Open the Exchange Management Shell and enter the following command:

  Get-SendConnector | Select Name, Identity, MaxMessageSize

  For each send connector, if the value of "MaxMessageSize" is not the same as the global value, this is a finding.

  or

  If "MaxMessageSize" is set to a numeric value different from the maximum message send size value documented in the EDSP, this is a finding.


vuln_id: V-221224
rule_id: SV-221224r961155_rule
severity: CAT III
title: Exchange Send connectors delivery retries must be controlled.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This setting controls the rate at which delivery attempts from the home domain are retried and user notifications are issued and notes the expiration time when the message will be discarded.  

  If delivery retry attempts are too frequent, servers will generate network congestion. If they are too far apart, messages may remain queued longer than necessary, potentially raising disk resource requirements.

  The default values of these fields should be adequate for most environments. Administrators may wish to modify the values, but changes should be documented in the System Security Plan.

  Note: Transport configuration settings apply to the organization/global level of the Exchange SMTP path. By checking and setting them at the Hub server, the setting will apply to both Hub and Edge roles.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the value for Transient Failure Retry Count.

  Open the Exchange Management Shell and enter the following command:

  Set-TransportService -Identity <'IdentityName'> -TransientFailureRetryCount 10

  Note: The <IdentityName> value must be in single quotes.

  or

  The value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the value for Transient Failure Retry Count.

  Open the Exchange Management Shell and enter the following command:

  Get-TransportService | Select Name, Identity, TransientFailureRetryCount

  If the value of "TransientFailureRetryCount" is not set to "10" or less, this is a finding.

  or

  If the value of "TransientFailureRetryCount" is set to more than "10" or has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-221225
rule_id: SV-221225r961155_rule
severity: CAT III
title: Exchange Send connectors must be clearly named.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>For Send connectors, unclear naming as to direction and purpose increases risk that messages may not flow as intended, troubleshooting efforts may be impaired, or incorrect assumptions may be made about the completeness of the configuration.  

  Collectively, connectors should account for all connections required for the overall email topology design. Simple Mail Transfer Protocol (SMTP) connectors, when listed, must name purpose and direction clearly, and their counterparts on servers to which they connect should be recognizable as their partners.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SendConnector -Name <'NewName'> -Identity <'IdentityName'>

  Note: Both the <NewName> and <IdentityName> values must be in single quotes.

  Repeat the procedure for each send connector.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-SendConnector | Select Name, Identity

  Review the naming for connectors. 

  For each send connector, if the connectors are not clearly named for purpose and direction, this is a finding.


vuln_id: V-221226
rule_id: SV-221226r961155_rule
severity: CAT II
title: Exchange Receive connector Maximum Hop Count must be 60.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. This setting controls the maximum number of hops (email servers traversed) a message may take as it travels to its destination. Part of the original Internet protocol implementation, the hop count limit prevents a message from being passed in a routing loop indefinitely. Messages exceeding the maximum hop count are discarded undelivered. 

  Recent studies indicate that virtually all messages can be delivered in fewer than 60 hops. If the hop count is set too low, messages may expire before they reach their destinations. If set too high, an undeliverable message may cycle between servers, raising the risk of network congestion.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the value for Receive connectors.

  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -MaxHopCount 60

  Note: The <IdentityName> value must be in single quotes.

  or

  The value as identified by the EDSP that has obtained a signoff with risk acceptance.

  Repeat the procedure for each receive connector.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the value for Receive connectors.

  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, MaxHopCount

  For each receive connector, if the value of "MaxHopCount" is not set to "60", this is a finding.  

  or 

  If the value of "MaxHopCount" is set to a value other than "60" and has signoff and risk acceptance, this is not a finding.


vuln_id: V-221227
rule_id: SV-221227r961155_rule
severity: CAT III
title: Exchange Receive connectors must be clearly named.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>For receive connectors, unclear naming as to direction and purpose increases risk that messages may not flow as intended, troubleshooting efforts may be impaired, or incorrect assumptions may be made about the completeness of the configuration.  

  Collectively, connectors should account for all connections required for the overall email topology design. Simple Mail Transfer Protocol (SMTP) connectors, when listed, must name purpose and direction clearly, and their counterparts on servers to which they connect should be recognizable as their partners.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Name <'NewName'> -Identity <'IdentityName'>

  Note: Both the <NewName> and <IdentityName> value must be in single quotes.

  Repeat the procedure for each receive connector.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity

  For each Receive connector, review the naming for connectors.

  If the connectors are not clearly named for purpose and direction, this is a finding.


vuln_id: V-221228
rule_id: SV-221228r961155_rule
severity: CAT III
title: Exchange Receive connectors must control the number of recipients chunked on a single message.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. For message size restrictions, multiple places exist to set or override inbound or outbound message size. Failure to control the configuration strategy can result in loss of data or system availability.
   
  This setting enables the administrator to enable "chunking" on received messages as they arrive at the domain. This is done so large message bodies can be relayed by the remote sender to the Receive connector in multiple, smaller chunks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -ChunkingEnabled $true

  Note: The <IdentityName> value must be in single quotes.

  Repeat the procedure for each receive connector.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, ChunkingEnabled

  For each receive connector, if the value of "ChunkingEnabled" is not set to "True", this is a finding.


vuln_id: V-221229
rule_id: SV-221229r961155_rule
severity: CAT II
title: Exchange Receive connectors must control the number of recipients per message.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. 

  This configuration controls the maximum number of recipients who will receive a copy of a message at one time. This tunable value is related to throughput capacity and can enable the ability to optimize message delivery. 

  Note: There are two types of default Receive connecters:

  "Client Servername" accepts SMTP connections from all non-MAPI clients, such as POP and IMAP. As POP and IMAP are not authorized for use in DoD, these should not be present. Their default value for MaxRecipientsPerMessage is 200. IMAP Secure is not restricted and may be configured.


  "Default Servername" accepts connections from other mailbox servers and any Edge Transport servers. Their default value for MaxRecipientsPerMessage is 5000.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the Maximum Recipients per Message value.

  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -MaxRecipientsPerMessage 5000 

  Note: The <IdentityName> value must be in single quotes.

  or 

  The value as identified by the EDSP that has obtained a signoff with risk acceptance.

  Repeat the procedure for each receive connector.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the Maximum Recipients per Message value.

  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, MaxRecipientsPerMessage

  For each receive connector, if the value of "MaxRecipientsPerMessage" is not set to "5000", this is a finding.

  or

  If the value of "MaxRecipientsPerMessage" is set to a value other than "5000" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-221230
rule_id: SV-221230r961155_rule
severity: CAT III
title: The Exchange Internet Receive connector connections count must be set to default.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. This configuration controls the maximum number of simultaneous inbound connections allowed to the SMTP server. 

  By default, the number of simultaneous inbound connections is 5000. If a limit is set too low, the connections pool may be filled. If attackers perceive the limit is too low, they could deny service to the Simple Mail Transfer Protocol (SMTP) server by using a connection count that exceeds the limit set. By setting the default configuration to 5000, attackers would need many more connections to cause denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the Maximum Inbound connections value.

  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -MaxInboundConnection 5000

  Note: The <IdentityName> value must be in single quotes.

  or

  The value as identified by the EDSP that has obtained a signoff with risk acceptance.

  Repeat the procedure for each receive connector.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the Maximum Inbound connections value. 

  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, MaxInboundConnection

  Identify Internet-facing connectors.

  For each receive connector, if the value of "MaxInboundConnection" is not set to "5000", this is a finding.

  or

  If "MaxInboundConnection" is set to a value other than "5000" or is set to unlimited and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-221231
rule_id: SV-221231r961155_rule
severity: CAT III
title: Exchange Message size restrictions must be controlled on Receive connectors.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practices strategies for setting tuning configurations. For message size restrictions, multiple places exist to set or override inbound or outbound message size. Failure to control the configuration strategy can result in loss of data or system availability. 

  This setting enables the administrator to control the maximum message size on Receive connectors. Using connectors to control size limits may necessitate applying message size limitations in multiple places, with the potential of introducing conflicts and impediments in the mail flow. Changing this setting at the connector overrides the global one. Therefore, if operational needs require it, the connector value may be set lower than the global value with the rationale documented in the EDSP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the global maximum message receive size.

  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -MaxMessageSize <'MaxReceiveSize'>

  Note: The <IdentityName> and <MaxReceiveSize> values must be in single quotes.

  or 

  The value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the global maximum message receive size. 

  Open the Exchange Management Shell and enter the following command:

  Identify Internet-facing connectors. 

  Get-ReceiveConnector | Select Name, Identity, MaxMessageSize 

  If the value of "MaxMessageSize" is not the same as the global value, this is a finding.

  or

  If "MaxMessageSize" is set to a numeric value different from the global value and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-221232
rule_id: SV-221232r961161_rule
severity: CAT II
title: Exchange messages with a blank sender field must be rejected.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By performing filtering at the perimeter, up to 90 percent of spam, malware, and other undesirable messages are eliminated from the message stream rather than admitting them into the mail server environment. Anonymous email (messages with blank sender fields) cannot be replied to. Messages formatted in this way may be attempting to hide their true origin to avoid responses or to spam any receiver with impunity while hiding their source of origination.

  Rather than spend resources and risk infection while evaluating them, it is recommended that these messages be filtered immediately upon receipt and not forwarded to end users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SenderFilterConfig -Action Reject

check_text:
  This requirement is N/A for SIPR enclaves.  

  This requirement is N/A if the organization subscribes to EEMSG or other similar DoD enterprise protections for email services.

  Open the Exchange Management Shell and enter the following command:

  Get-SenderFilterConfig | Select Name, Action 

  If the value of "Action" is not set to "Reject", this is a finding.


vuln_id: V-221233
rule_id: SV-221233r961161_rule
severity: CAT II
title: Exchange messages with a blank sender field must be filtered.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By performing filtering at the perimeter, up to 90 percent of spam, malware, and other undesirable messages are eliminated from the message stream rather than admitting them into the mail server environment. Anonymous email (messages with blank sender fields) cannot be replied to. Messages formatted in this way may be attempting to hide their true origin to avoid responses or to spam any receiver with impunity while hiding their source of origination.  

  Rather than spend resources and risk infection while evaluating them, it is recommended that these messages be filtered immediately upon receipt and not forwarded to end users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SenderFilterConfig -BlankSenderBlockingEnabled $true

check_text:
  This requirement is N/A for SIPR enclaves. 

  This requirement is N/A if the organization subscribes to EEMSG or other similar DoD enterprise protections for email services.

  Open the Exchange Management Shell and enter the following command:

  Get-SenderFilterConfig | Select Name, BlankSenderBlockingEnabled

  If the value of "BlankSenderBlockingEnabled" is not set to "True", this is a finding.


vuln_id: V-221234
rule_id: SV-221234r961161_rule
severity: CAT II
title: Exchange filtered messages must be archived.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By performing filtering at the perimeter, up to 90 percent of spam, malware, and other undesirable messages are eliminated from the message stream rather than admitting them into the mail server environment. This significantly reduces the attack vector for inbound email-borne spam and malware. 

  As messages are filtered, it is prudent to temporarily host them in an archive for evaluation by administrators or users. The archive can be used to recover messages that might have been inappropriately filtered, preventing data loss, and to provide a base of analysis that can provide future filter refinements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ContentFilterConfig -QuarantineMailbox <'QuarantineMailbox SmtpAddress'>

  Note: The <QuarantineMailbox SmtpAddress> value must be in single quotes.

check_text:
  Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement.

  Open the Exchange Management Shell and enter the following command:

  Get-ContentFilterConfig | Select Name, QuarantineMailbox

  If no SMTP address is assigned to "QuarantineMailbox", this is a finding.


vuln_id: V-221235
rule_id: SV-221235r961161_rule
severity: CAT II
title: The Exchange Sender filter must block unaccepted domains.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Spam origination sites and other sources of suspected email-borne malware have the ability to corrupt, compromise, or otherwise limit availability of email servers. Limiting exposure to unfiltered inbound messages can reduce the risk of spam and malware impacts. 

  The Global Deny list blocks messages originating from specific sources. Most blacklist filtering is done using a commercial Block List service, because eliminating threats from known spammers prevents the messages being evaluated inside the enclave where there is more risk they can do harm. 

  Additional sources should also be blocked to supplement the contents of the commercial Block List service. For example, during a zero-day threat action, entries can be added and then removed when the threat is mitigated. An additional best practice is to enter the enterprise’s home domains in the Deny List, because inbound email with a "from" address of the home domain is very likely to be spoofed spam.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the unaccepted domains that are to be blocked.

  Open the Exchange Management Shell and enter the following command:

  For BlockedDomains:

  Set-SenderFilterConfig -BlockedDomains <BlockedDomain>

  Repeat the procedure for each domain that is to be blocked.

  or

  For BlockedDomainsAndSubdomains:

  Set-SenderFilterConfig -BlockedDomainsAndSubdomains <BlockedDomainAndSubdomain>

  Repeat the procedure for each domain and all of its subdomains that are to be blocked.

check_text:
  Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement.

  Review the Email Domain Security Plan (EDSP).

  Determine the unaccepted domains that are to be blocked.  

  Open the Exchange Management Shell and enter the following command:

  Get-SenderFilterConfig | Select Name, BlockedDomains, BlockedDomainsAndSubdomains

  If the value for "BlockedDomains" or "BlockedDomainsAndSubdomains" does not reflect the list of unaccepted domains, this is a finding.


vuln_id: V-221236
rule_id: SV-221236r961161_rule
severity: CAT II
title: Exchange nonexistent recipients must not be blocked.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Spam originators, in an effort to refine mailing lists, sometimes use a technique where they first create fictitious names and then monitor rejected emails for non-existent recipients. Those not rejected are deemed to exist and are used in future spam mailings. 

  To prevent this disclosure of existing email accounts to spammers, email to nonexistent recipients must not be blocked. Instead, it is recommended that all messages be received, then evaluated and disposed of without enabling the sender to determine existent vs. nonexistent recipients.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-RecipientFilterConfig -RecipientValidationEnabled $false

check_text:
  Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement.

  Open the Exchange Management Shell and enter the following command:

  Get-RecipientFilterConfig | Select Name, RecipientValidationEnabled

  If the value of "RecipientValidationEnabled" is not set to "False", this is a finding.


vuln_id: V-221237
rule_id: SV-221237r961161_rule
severity: CAT II
title: The Exchange Sender Reputation filter must be enabled.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By performing filtering at the perimeter, up to 90 percent of spam, malware, and other undesirable messages are eliminated from the message stream rather than admitting them into the mail server environment. Sender Reputation is antispam functionality that blocks messages according to many characteristics of the sender. Sender Reputation relies on persisted data about the sender to determine what action, if any, to take on an inbound message. This setting enables the Sender Reputation function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:
   
  Set-SenderReputationConfig -Enabled $true

check_text:
  Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement.

  Open the Exchange Management Shell and enter the following command:
   
  Get-SenderReputationConfig | Select Name, Enabled

  If the value of "Enabled" is not set to "True", this is a finding.


vuln_id: V-221238
rule_id: SV-221238r961161_rule
severity: CAT II
title: The Exchange Sender Reputation filter must identify the spam block level.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By performing filtering at the perimeter, up to 90 percent of spam, malware, and other undesirable messages are eliminated from the message stream rather than admitting them into the mail server environment. Sender Reputation is antispam functionality that blocks messages according to many characteristics of the sender. Sender Reputation relies on persisted data about the sender to determine what action, if any, to take on an inbound message. This setting enables the threshold at which an email will be considered spam.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the SrlBlockThreshold size. 

  Open the Exchange Management Shell and enter the following command:

  Set-SenderReputationConfig -SrlBlockThreshold 6

  or

  The value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement.

  Review the Email Domain Security Plan (EDSP).

  Determine the SrlBlockThreshold value. 

  Open the Exchange Management Shell and enter the following command:
   
  Get-SenderReputationConfig | Select Name, SrlBlockThreshold

  If the value of SrlBlockThreshold is not set to "6", this is a finding.

  or

  If the value of "SrlBlockThreshold" is set to a value other than "6" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-221239
rule_id: SV-221239r961161_rule
severity: CAT II
title: Exchange Attachment filtering must remove undesirable attachments by file type.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By performing filtering at the perimeter, up to 90 percent of spam, malware, and other undesirable messages are eliminated from the message stream rather than admitting them into the mail server environment. 

  Attachments are being used more frequently for different forms of attacks. By filtering undesirable attachments, a large percent of malicious code can be prevented from entering the system. Attachments must be controlled at the entry point into the email environment to prevent successful attachment-based attacks. The following is a basic list of known attachments that should be filtered from Internet mail attachments:

  *.ade  *.crt  *.jse  *.msi  *.scr  *.wsh  *.dir
  *.adp  *.csh  *.ksh  *.msp  *.sct  *.htm  *.dcr
  *.app  *.exe  *.lnk  *.mst  *.shb  *.html  *.plg
  *.asx  *.fxp  *.mda  *.ops  *.shs  *.htc  *.spl
  *.bas  *.hlp  *.mdb  *.pcd  *.url  *.mht  *.swf
  *.bat  *.hta  *.mde  *.pif  *.vb  *.mhtml  *.zip
  *.chm  *.inf  *.mdt  *.prf  *.vbe  *.shtm  
  *.cmd  *.ins  *.mdw  *.prg  *.vbs  *.shtml  
  *.com  *.isp  *.mdz  *.reg  *.wsc  *.stm  
  *.cpl  *.js  *.msc  *.scf  *.wsf  *.xml</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the list of undesirable attachment types that should be stripped.

  Open the Exchange Management Shell and enter the following command:

  Add-AttachmentFilterEntry -Name <'*.FileExtension'> -Type FileName

  Repeat the procedure for each undesirable attachment type.

check_text:
  Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement.

  Review the Email Domain Security Plan (EDSP).

  Determine the list of undesirable attachment types that should be stripped.

  Open the Exchange Management Shell and enter the following command:

  Get-AttachmentFilterEntry 

  For each attachment type, if the values returned are different from the EDSP documented attachment types, this is a finding.


vuln_id: V-221240
rule_id: SV-221240r961161_rule
severity: CAT II
title: The Exchange Spam Evaluation filter must be enabled.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>By performing filtering at the perimeter, up to 90 percent of spam, malware, and other undesirable messages may be eliminated from the transport message stream, preventing their entry into the Exchange environment. This significantly reduces the attack vector for inbound email-borne spam and malware.

  Spam Evaluation filters scan inbound email messages for evidence of spam and other attacks that primarily use "social engineering" techniques. Upon evaluation completion, a rating is assigned to each message estimating the likelihood of its being spam. Upon arrival at the destination mailbox, the junk mail filter threshold (also configurable) determines whether the message will be withheld from delivery, delivered to the junk mail folder, or delivered to the user’s inbox.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ContentFilterConfig -Enabled $true

check_text:
  Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement.

  Open the Exchange Management Shell and enter the following command:

  Get-ContentFilterConfig | Select Name, Identity, Enabled

  If the value of "Enabled" is not set to "True", this is a finding.


vuln_id: V-221241
rule_id: SV-221241r961161_rule
severity: CAT II
title: The Exchange Block List service provider must be identified.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Block List filtering is a sanitization process performed on email messages prior to their arrival at the destination mailbox. By performing this process at the email perimeter, threats can be eliminated outside the enclave, where there is less risk for them to do harm.
   
  Block List services (sometimes called Reputation Data services) are fee-based data providers that collect the IP addresses of known spammers and other malware purveyors. Block List service subscribers benefit from more effective spam elimination. (Spam is estimated to compose up to 90 percent of inbound mail volume.) Failure to specify a Block List provider risks that manual email administration effort would be needed to maintain and update larger Block Lists than a single email site administrator could conveniently or accurately maintain. 

  The Block List service vendor provides a value for this field, usually the Domain Name System (DNS) suffix for its domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the name and information for the Block List provider.

  Open the Exchange Management Shell and enter the following command:

  Set-IPBlockListProvider -Name <Provider Name> [Additional optional parameters as required by the service provider]

check_text:
  If not using a service provider, this requirement is not applicable. 

  Review the Email Domain Security Plan (EDSP).

  Determine the name and information for the Block List provider.   

  Open the Exchange Management Shell and enter the following command:

  Get-IPBlockListProvider | Select Name, Identity, LookupDomain

  If the values for "Name", GUID, and "LookupDomain" are not configured, this is a finding.


vuln_id: V-221242
rule_id: SV-221242r1040907_rule
severity: CAT II
title: Exchange messages with a malformed From address must be rejected.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Sender Identification (SID) is an email antispam sanitization process. Sender ID uses DNS MX record lookups to verify the Simple Mail Transfer Protocol (SMTP) sending server is authorized to send email for the originating domain.
   
  Failure to implement Sender ID risks that spam could be admitted into the email domain that originates from rogue servers. Most spam content originates from domains where the IP address has been spoofed prior to sending, thereby avoiding detection. For example, messages with malformed or incorrect "purported responsible sender" data in the message header could be (best case) created by using RFI noncompliant software but is more likely to be spam.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SenderIdConfig -SpoofedDomainAction Reject

check_text:
  If this server is in a SIPR Enclave, this requirement is Not Applicable.

  Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement.

  Open the Exchange Management Shell and enter the following command:

  Get-SenderIdConfig | Select Name, Identity, SpoofedDomainAction

  If the value of "SpoofedDomainAction" is not set to "Reject", this is a finding.


vuln_id: V-221243
rule_id: SV-221243r961161_rule
severity: CAT II
title: The Exchange Recipient filter must be enabled.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. Careful tuning reduces the risk that system or network congestion will contribute to availability impacts. 

  Filters that govern inbound email evaluation can significantly reduce spam, phishing, and spoofed emails. Messages from blank senders, known spammers, or zero-day attack modifications must be enabled to be effective.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-RecipientFilterConfig -Enabled $true

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-RecipientFilterConfig | Select Name, Enabled

  If the value of "Enabled" is not set to "True", this is a finding.


vuln_id: V-221244
rule_id: SV-221244r961161_rule
severity: CAT II
title: The Exchange tarpitting interval must be set.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Tarpitting is the practice of artificially delaying server responses for specific Simple Mail Transfer Protocol (SMTP) communication patterns that indicate high volumes of spam or other unwelcome messages. The intent of tarpitting is to slow down the communication process for spam batches to reduce the cost effectiveness of sending spam and thwart directory harvest attacks.  

  A directory harvest attack is an attempt to collect valid email addresses from a particular organization so the email addresses can be added to a spam database. A program can be written to collect email addresses that return a "Recipient OK" SMTP response and discard all email addresses that return a "User unknown" SMTP response.

  Tarpitting makes directory harvest attacks too costly to automate efficiently.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -TarpitInterval '00:00:05'

  Note: The <IdentityName> value and the Interval must be in single quotes.

  Repeat the procedures for each Receive connector.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, TarpitInterval

  For each Receive connector, if the value of "TarpitInterval" is not set to "00:00:05" or greater, this is a finding.


vuln_id: V-221245
rule_id: SV-221245r961161_rule
severity: CAT II
title: Exchange internal Receive connectors must not allow anonymous connections.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This control is used to limit the servers that may use this server as a relay. If a Simple Mail Transport Protocol (SMTP) sender does not have a direct connection to the Internet (for example, an application that produces reports to be emailed), it will need to use an SMTP Receive connector that does have a path to the Internet (for example, a local email server) as a relay.

  SMTP relay functions must be protected so third parties are not able to hijack a relay service for their own purposes. Most commonly, relay hijacking is done by spammers to disguise the source of their messages and may also be used to cover the source of more destructive attacks.  
   
  Relays can be restricted in one of three ways: by blocking relays (restrict to a blank list of servers); by restricting use to lists of valid servers; or by restricting use to servers that can authenticate. Because authenticated connections are the most secure for SMTP Receive connectors, it is recommended that relays allow only servers that can authenticate.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -PermissionGroups 'valid user group(s)'

  Note: The <IdentityName> value and user group(s) must be in single quotes.

  Example for user groups only: 'ExchangeServers, ExchangeUsers' 

  Repeat the procedures for each Receive connector.

  This is an Example only: Set-ReceiveConnector -Identity <'IdentityName'> -PermissionGroups 'ExchangeUsers'

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, PermissionGroups

  For each Receive connector, if the value of "PermissionGroups" is "AnonymousUsers" for any non-Internet connector, this is a finding.


vuln_id: V-221246
rule_id: SV-221246r961161_rule
severity: CAT II
title: Exchange Simple Mail Transfer Protocol (SMTP) IP Allow List entries must be empty.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. Careful tuning reduces the risk that system or network congestion will contribute to availability impacts. 

  Filters that govern inbound email evaluation can significantly reduce spam, phishing, and spoofed emails. Filters for messages from blank senders, known spammers, or zero-day attack modifications must be enabled to be effective. 

  Having items identified in the Allow List causes other spam evaluation steps to be bypassed and therefore should be used only with an abundance of caution. If spammers were to learn of entries in the Allow List, it could enable them to plan a denial of service attack (or other attack) by spoofing that source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the SMTP allow list settings.

  Open the Exchange Management Shell and enter the following command:

  Note: Remove any value(s) that are not identified by the EDSP or have not obtained a signoff with risk acceptance.

  Remove-IPAllowListEntry -Identity <IP Allow List entry ID>

check_text:
  Review the Email Domain Security Plan (EDSP).

  Identify the SMTP allow list settings. 

  Open the Exchange Management Shell and enter the following command:

  Get-IPAllowListEntry | fl
   
  If the result returns any values, this is a finding.   

  or 

  If the result returns any values but has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-221247
rule_id: SV-221247r961161_rule
severity: CAT II
title: The Exchange Simple Mail Transfer Protocol (SMTP) IP Allow List Connection filter must be enabled.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. Careful tuning reduces the risk that system or network congestion will contribute to availability impacts. 

  Filters that govern inbound email evaluation can significantly reduce spam, phishing, and spoofed emails. Filters for messages from blank senders, known spammers, or zero-day attack modifications must be enabled to be effective. 

  Having items identified in the Allow List causes other spam evaluation steps to be bypassed and therefore should be used only with an abundance of caution. If spammers were to learn of entries in the Allow List, it could enable them to plan a denial of service attack (or other attack) by spoofing that source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-IPAllowListConfig -Enabled $true

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-IPAllowListConfig | Select Name, Enabled
   
  If the value for "Enabled" is not set to "True", this is a finding.


vuln_id: V-221248
rule_id: SV-221248r961161_rule
severity: CAT II
title: The Exchange Simple Mail Transfer Protocol (SMTP) Sender filter must be enabled.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practices strategies for setting tuning configurations. Careful tuning reduces the risk that system or network congestion will contribute to availability impacts. 

  Filters that govern inbound email evaluation can significantly reduce spam, phishing, and spoofed emails. Filters for messages from blank senders, known spammers, or zero-day attack modifications must be enabled to be effective. 

  Failure to enable the filter will result in no action taken. This setting should always be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SenderFilterConfig -Enabled $true

check_text:
  This requirement is N/A for SIPR enclaves.  

  This requirement is N/A if the organization subscribes to EEMSG or other similar DoD enterprise protections for email services.

  Open the Exchange Management Shell and enter the following command:
   
  Get-SenderFilterConfig | Select Name, Enabled

  If the value of "Enabled" is not set to "True", this is a finding.


vuln_id: V-221249
rule_id: SV-221249r961161_rule
severity: CAT II
title: Exchange must have antispam filtering installed.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Originators of spam messages are constantly changing their techniques in order to defeat spam countermeasures; therefore, spam software must be constantly updated to address the changing threat. Spam protection mechanisms include, for example, signature definitions, rule sets, and algorithms.

  Exchange 2016 provides both antispam and antimalware protection out of the box. The Exchange 2016 antispam and antimalware product capabilities are limited but still provide some protection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Install the AntiSpam module. 

  Open the Exchange Management Shell and enter the following command:

  & $env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1

check_text:
  Review the Email Domain Security Plan (EDSP) for an installed antispam product.

  Note: If using another DoD-approved antispam product for email or a DoD-approved Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable.

  Open the Exchange Management Shell and enter the following command:

  Get-ContentFilterConfig | Format-Table Name, Enabled   

  If no value is returned, this is a finding.


vuln_id: V-221250
rule_id: SV-221250r961161_rule
severity: CAT II
title: Exchange must have antispam filtering enabled.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Originators of spam messages are constantly changing their techniques in order to defeat spam countermeasures; therefore, spam software must be constantly updated to address the changing threat. Spam protection mechanisms include, for example, signature definitions, rule sets, and algorithms.

  Exchange 2016 provides both antispam and antimalware protection out of the box. The Exchange 2016 antispam and antimalware product capabilities are limited but still provide some protection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command for any values that were not set to True:

  Set-ContentFilterConfig -Enabled $true

  Set-SenderFilterConfig -Enabled $true

  Set-SenderIDConfig -Enabled $true

  Set-SenderReputationConfig -Enabled $true

check_text:
  Review the Email Domain Security Plan (EDSP) for an installed antispam product.

  Note: If using another DoD-approved antispam product for email or a DoD-approved Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable.

  Open the Exchange Management Shell and enter the following command:

  Get-ContentFilterConfig | Format-Table Name, Enabled; Get-SenderFilterConfig | Format-Table Name, Enabled; Get-SenderIDConfig | Format-Table Name, Enabled; Get-SenderReputationConfig | Format-Table Name, Enabled

  If any of the following values returned are not set to "True", this is a finding:

  Set-ContentFilterConfig 
  Set-SenderFilterConfig 
  Set-SenderIDConfig 
  Set-SenderReputationConfig


vuln_id: V-221251
rule_id: SV-221251r961161_rule
severity: CAT II
title: Exchange must have antispam filtering configured.
fix_text: Following vendor best practice guidance, install and configure a DoD approved scanner.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Originators of spam messages are constantly changing their techniques in order to defeat spam countermeasures; therefore, spam software must be constantly updated to address the changing threat. A manual update procedure is labor intensive and does not scale well in an enterprise environment. This risk may be mitigated by using an automatic update capability. Spam protection mechanisms include, for example, signature definitions, rule sets, and algorithms.

  Exchange 2016 provides both antispam and antimalware protection out of the box. The Exchange 2016 antispam and antimalware product capabilities are limited but still provide some protection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Site should utilize an approved DoD scanner as Exchange Malware software has a limited scanning capability.

  If an approved DoD scanner is not being used, this is a finding.


vuln_id: V-221252
rule_id: SV-221252r961161_rule
severity: CAT II
title: Exchange Sender Identification Framework must be enabled.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email is only as secure as the recipient. When the recipient is an email server accepting inbound messages, authenticating the sender enables the receiver to better assess message quality and to validate the sending domain as authentic. One or more authentication techniques used in combination can be effective in reducing spam, phishing, and forger attacks. 

  The Sender ID Framework (SIDF) receiver accesses specially formatted DNS records (SPF format) that contain the IP address of authorized sending servers for the sending domain that can be compared to data in the email message header. Receivers are able to validate the authenticity of the sending domain, helping to avoid receiving inbound messages from phishing or other spam domains.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SenderIdConfig -Enable $true

check_text:
  Note: If third-party anti-spam product is being used, the anti-spam product must be configured to meet the requirement.

  Open the Exchange Management Shell and enter the following command:

  Get-SenderIdConfig | Select Name, Identity, Enabled

  If the value of "Enabled" is not set to "True", this is a finding.


vuln_id: V-221253
rule_id: SV-221253r961161_rule
severity: CAT I
title: Exchange must render hyperlinks from email sources from non-.mil domains as unclickable.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Active hyperlinks within an email are susceptible to attacks of malicious software or malware. The hyperlink could lead to a malware infection or redirect the website to another fraudulent website without the user's consent or knowledge. 

  Exchange does not have a built-in message filtering capability. DoD Enterprise Email (DEE) has created a custom resolution to filter messages from non-.mil users that have hyperlinks in the message body. The hyperlink within the messages will be modified, preventing end users from automatically clicking links.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the name of the Transport Agent.

  Contact the DISA Enterprise Email Service Desk at disa.tinker.eis.mbx.dod-enterprise-services-service-desk@mail.mil and request the Agent and installation procedures.

  or

  Contact DEE Engineering PMO and request the Agent and installation procedures.

check_text:
  Note: If using a DoD-approved protection mechanism such as Cloud Based Internet Isolation (CBII), Bromium, Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), or other approved email sanitization solution that protects against untrusted URLs embedded in email, this is not applicable.

  Note: If system is on SIPRNet, this is not applicable.

  Review the Email Domain Security Plan (EDSP).

  Determine the name of the Transport Agent. 

  Open the Windows PowerShell console and enter the following command:

  Get-TransportAgent -Name 'customAgent' | FL

  If the value does not return "customAgent", this is a finding.

  Note: "customAgent" is the name of the custom agent developed to render hyperlink email sources from non .mil domains as unclickable.


vuln_id: V-221254
rule_id: SV-221254r961455_rule
severity: CAT II
title: The Exchange application directory must be protected from unauthorized access.
cci: CCI-001812
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Default product installations may provide more generous access permissions than are necessary to run the application. By examining and tailoring access permissions to more closely provide the least amount of privilege possible, attack vectors that align with user permissions are less likely to access more highly secured areas.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the authorized groups and users that have access to the Exchange application directories.

  Navigate to the Exchange application directory and remove or modify the group or user access permissions. 

  Note: The default installation directory is \Program Files\Microsoft\Exchange Server\V15.

check_text:
  Review the Email Domain Security Plan (EDSP). 

  Determine the authorized groups and users that have access to the Exchange application directories.

  Determine if the access permissions on the directory match the access permissions listed in the EDSP. 

  If any group or user has different access permissions than listed in the EDSP, this is a finding. 

  Note: The default installation directory is \Program Files\Microsoft\Exchange Server\V15.


vuln_id: V-221255
rule_id: SV-221255r961461_rule
severity: CAT II
title: The Exchange software baseline copy must exist.
fix_text: Implement an email software baseline process and update the EDSP.
cci: CCI-001813
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Exchange software, as with other application software installed on a host system, must be included in a system baseline record and periodically reviewed; otherwise, unauthorized changes to the software may not be discovered. This effort is a vital step to securing the host and the applications, as it is the only method that may provide the ability to detect and recover from otherwise undetected changes, such as those that result from worm or bot intrusions. 

  The Exchange software and configuration baseline is created and maintained for comparison during scanning efforts. Operational procedures must include baseline updates as part of configuration management tasks that change the software and configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the baseline documentation.  

  Review the application software baseline procedures and implementation artifacts. 

  Note the list of files and directories included in the baseline procedure for completeness. 

  If an email software copy exists to serve as a baseline and is available for comparison during scanning efforts, this is not a finding.


vuln_id: V-221256
rule_id: SV-221256r961470_rule
severity: CAT II
title: Exchange services must be documented and unnecessary services must be removed or disabled.
cci: CCI-001762
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Unneeded but running services offer attackers an enhanced attack profile, and attackers are constantly watching to discover open ports with running services. By analyzing and disabling unneeded services, the associated open ports become unresponsive to outside queries, and servers become more secure as a result.  
   
  Exchange Server has role-based server deployment to enable protocol path control and logical separation of network traffic types.   

  For example, a server implemented in the Client Access role (i.e., Outlook Web App [OWA]) is configured and tuned as a web server using web protocols. A client access server exposes only web protocols (HTTP/HTTPS), enabling system administrators to optimize the protocol path and disable all services unnecessary for Exchange web services.

  Similarly, servers created to host mailboxes are dedicated to that task and must operate only the services needed for mailbox hosting. (Exchange servers must also operate some web services, but only to the degree that Exchange requires the IIS engine in order to function).   

  Because POP3 and IMAP4 clients are not included in the standard desktop offering, they must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP with the services required for the system to function. 

  Navigate to Administrator Tools >> Services and disable or remove any services that are not required.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Note: Required services will vary between organizations and will vary depending on the role of the individual system. Organizations will develop their own list of services, which will be documented and justified with the ISSO. The site’s list will be provided for any security review. Services that are common to multiple systems can be addressed in one document. Exceptions for individual systems should be identified separately by system.

  Open a Windows PowerShell and enter the following command:

  Get-Service | Where-Object {$_.status -eq 'running'}

  Note: The command returns a list of installed services and the status of that service. 

  If the services required are not documented in the EDSP or undocumented or unnecessary services are running, this is a finding.


vuln_id: V-221257
rule_id: SV-221257r961608_rule
severity: CAT II
title: Exchange software must be installed on a separate partition from the OS.
cci: CCI-002530
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>In the same way that added security layers can provide a cumulative positive effect on security posture, multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to the host system can most likely lead to a compromise of all applications hosted by the same system.

  Email services should be installed on a partition that does not host other applications. Email services should never be installed on a Domain Controller/Directory Services server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the directory where Exchange is installed.

  Install Exchange on a dedicated application directory or partition separate than that of the OS.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the directory where Exchange is installed.

  Open Windows Explorer. 

  Navigate to the location where Exchange is installed. 

  If Exchange resides on a directory or partition other than that of the OS and does not have other applications installed (without associated approval from the ISSO), this is not a finding.


vuln_id: V-221258
rule_id: SV-221258r961620_rule
severity: CAT II
title: The Exchange SMTP automated banner response must not reveal server details.
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Automated connection responses occur as a result of FTP or Telnet connections when connecting to those services. They report a successful connection by greeting the connecting client and stating the name, release level, and (often) additional information about the responding product. While useful to the connecting client, connection responses can also be used by a third party to determine operating system or product release levels on the target server. The result can include disclosure of configuration information to third parties, paving the way for possible future attacks. For example, when querying the SMTP service on port 25, the default response looks similar to this one: 

  220 exchange.mydomain.org Microsoft ESMTP MAIL Service, Version: 6.0.3790.211 ready at Wed, 2 Feb 2005 23:40:00 -0500

  Changing the response to hide local configuration details reduces the attack profile of the target.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -Banner '220 SMTP Server Ready'

  Note: The <IdentityName> and 220 SMTP Server Ready values must be in single quotes.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, Banner

  If the value of "Banner" is not set to "220 SMTP Server Ready", this is a finding.


vuln_id: V-221259
rule_id: SV-221259r961620_rule
severity: CAT I
title: Exchange must provide redundancy.
cci: CCI-002418
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Denial of Service (DoS) is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.

  This requirement addresses the configuration of applications to mitigate the impact of DoS attacks that have occurred or are ongoing on application availability. For each application, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or restricting the number of sessions the application opens at one time). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to reflect the Exchange servers used for redundancy.

  Configure two or more Edge servers for load balancing.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine if the Exchange servers are using redundancy by entering the following command:

  Get-TransportService | select FL 

  If the value returned is not at least two Edge servers, this is a finding.


vuln_id: V-221260
rule_id: SV-221260r961620_rule
severity: CAT II
title: Exchange internal Send connectors must use an authentication level.
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Simple Mail Transfer Protocol (SMTP) connector is used by Exchange to send and receive messages from server to server. Several controls work together to provide security between internal servers. This setting controls the encryption method used for communications between servers. With this feature enabled, only servers capable of supporting Transport Layer Security (TLS) will be able to send and receive mail within the domain.

  The use of secure communication prevents eavesdroppers from reading or modifying communications between mail clients and servers. While sensitive message bodies should be encrypted by the sender at the client, requiring a secure connection from server to server adds protection by encrypting the sender and recipient information that cannot be encrypted by the sender. 

  Individually, channel security and encryption can be compromised by attackers. Used together, email becomes a more difficult target, and security is heightened. Failure to enable this feature gives eavesdroppers an opportunity to read or modify messages between servers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SendConnector -Identity <'IdentityName'> -TlsAuthLevel DomainValidation

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-SendConnector | Select Name, Identity, TlsAuthLevel

  If the value of "TlsAuthLevel" is not set to "DomainValidation", this is a finding.


vuln_id: V-221261
rule_id: SV-221261r961632_rule
severity: CAT I
title: Exchange internal Receive connectors must require encryption.
cci: CCI-002418
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Simple Mail Transfer Protocol (SMTP) Receive connector is used by Exchange to send and receive messages from server to server using SMTP protocol. This setting controls the encryption strength used for client connections to the SMTP Receive connector. With this feature enabled, only clients capable of supporting secure communications will be able to send mail using this SMTP server. Where secure channels are required, encryption can also be selected. 

  The use of secure communication prevents eavesdroppers from reading or modifying communications between mail clients and servers. While sensitive message bodies should be encrypted by the sender at the client, requiring a secure connection from the client to the server adds protection by encrypting the sender and recipient information that cannot be encrypted by the sender.  

  Individually, channel security and encryption have been compromised by attackers. Used together, email becomes a more difficult target, and security is heightened. Failure to enable this feature gives eavesdroppers an opportunity to read or modify messages between the client and server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -AuthMechanism 'Tls'

  Note: The <IdentityName> value must be in single quotes.

  Repeat the process for each Receive connector.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, AuthMechanism

  For each Receive connector, if the value of "AuthMechanism" is not set to "Tls", this is a finding.


vuln_id: V-221262
rule_id: SV-221262r961632_rule
severity: CAT I
title: Exchange internal Send connectors must require encryption.
cci: CCI-002418
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Simple Mail Transfer Protocol (SMTP) connector is used by Exchange to send and receive messages from server to server. Several controls work together to provide security between internal servers. This setting controls the encryption method used for communications between servers. With this feature enabled, only servers capable of supporting Transport Layer Security (TLS) will be able to send and receive mail within the domain.

  The use of secure communication prevents eavesdroppers from reading or modifying communications between mail clients and servers. While sensitive message bodies should be encrypted by the sender at the client, requiring a secure connection from server to server adds protection by encrypting the sender and recipient information that cannot be encrypted by the sender. 

  Individually, channel security and encryption can be compromised by attackers. Used together, email becomes a more difficult target, and security is heightened. Failure to enable this feature gives eavesdroppers an opportunity to read or modify messages between servers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SendConnector -Identity <'IdentityName'> -TlsDomain <'SMTP Domain'>

  Set-SendConnector -Identity <'ReceiveConnector'> -DomainSecureEnabled 'True'

  Note: The SMTP Domain is the internal SMTP domain within the organization.

  The following commands can be executed if smarthosts are used:

  Set-SendConnector <'IdentityName'> -RequireTLS $true -TlsAuthLevel $DomainValidation

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-SendConnector | Select Name, Identity, TlsDomain

  If the value of "TlsDomain" is not set to the value of the internal <'SMTP Domain'>, this is a finding.

  Get-SendConnector | Select Name, Identity, DomainSecureEnabled

  If the value of "DomainSecureEnabled" is not set to "True" and the SendConnector is not using a smarthost, this is a finding.

  If the value of "DomainSecureEnabled" is set to "False" and the send connector is using a smarthost, the value of  “RequireTLS” must be set to “True”, and the value for “TlsAuthLevel” must be set to “DomainValidation”.

  If the send connector using a smarthost has a value for “RequireTLS” that is not set to “True”, this is a finding.

  If the send connector using a smarthost has a value for “TlsAuthLevel” that is not set to “DomainValidation”, this is a Finding.


vuln_id: V-221263
rule_id: SV-221263r961683_rule
severity: CAT II
title: Exchange must have the most current, approved service pack installed.
fix_text: Install the most current, approved service pack.
cci: CCI-002605
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The organization (including any contractor to the organization) must promptly install security-relevant software updates (e.g., patches, service packs, hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ExchangeServer | fl name, AdminDisplayVersion

  If the value of "AdminDisplayVersion" does not return the most current, approved service pack, this is a finding.


vuln_id: V-221264
rule_id: SV-221264r961191_rule
severity: CAT II
cci: CCI-001241
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The application must configure malicious code protection mechanisms to perform periodic scans of the information system every seven days.

description:
  <VulnDiscussion>Malicious code protection mechanisms include, but are not limited, to anti-virus and malware detection software. In order to minimize potential negative impact to the organization that can be caused by malicious code, it is imperative that malicious code is identified and eradicated. 

  Malicious code includes viruses, worms, trojan horses, and spyware. It is not enough to simply have the software installed; this software must periodically scan the system to search for malware on an organization-defined frequency. 

  This requirement applies to applications providing malicious code protection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  & env:ExchangeInstallPath\Scripts\Disable-Antimalwarescanning.ps1

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-TransportAgent "Malware Agent"

  If the value of "Enabled" is set to "True", this is a finding.


vuln_id: V-221265
rule_id: SV-221265r961191_rule
severity: CAT II
cci: CCI-001241
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The application must configure malicious code protection mechanisms to perform periodic scans of the information system every seven days.

description:
  <VulnDiscussion>Malicious code protection mechanisms include, but are not limited, to anti-virus and malware detection software. In order to minimize potential negative impact to the organization that can be caused by malicious code, it is imperative that malicious code is identified and eradicated. 

  Malicious code includes viruses, worms, trojan horses, and spyware. It is not enough to simply have the software installed; this software must periodically scan the system to search for malware on an organization-defined frequency. 

  This requirement applies to applications providing malicious code protection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Following vendor best practice guidance, install and configure a third-party malicious code protection application.

check_text:
  Site must utilize an approved DoD third-party malicious code scanner.

  Consult with System Administrator to demonstrate the application being used to provide malicious code protection in the Exchange implementation.

  If System Administrator is unable to demonstrate a third-party malicious code protection application, this is a finding.

  If System Administrator is unaware of a third-party malicious code protection application, this is a finding.


vuln_id: V-221266
rule_id: SV-221266r961197_rule
severity: CAT II
cci: CCI-001243
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The application must be configured to block and quarantine malicious code upon detection, then send an immediate alert to appropriate individuals.

description:
  <VulnDiscussion>Malicious code protection mechanisms include, but are not limited, to anti-virus and malware detection software. In order to minimize potential negative impact to the organization that can be caused by malicious code, it is imperative that malicious code is identified and eradicated. 

  Applications providing this capability must be able to perform actions in response to detected malware. Responses include blocking, quarantining, deleting, and alerting. Other technology- or organization-specific responses may also be employed to satisfy this requirement.

  Malicious code includes viruses, worms, trojan horses, and spyware. 

  This requirement applies to applications providing malicious code protection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  & env:ExchangeInstallPath\Scripts\Disable-Antimalwarescanning.ps1

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-TransportAgent "Malware Agent"

  If the value of "Enabled" is set to "True", this is a finding.


vuln_id: V-221268
rule_id: SV-221268r961188_rule
severity: CAT II
cci: CCI-001240
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The application must update malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures.

description:
  <VulnDiscussion>Malicious code includes viruses, worms, trojan horses, and spyware. The code provides the ability for a malicious user to read from and write to files and folders on a computer's hard drive. Malicious code may also be able to run and attach programs, which may allow the unauthorized distribution of malicious mobile code. Once this code is installed on endpoints within the network, unauthorized users may be able to breach firewalls and gain access to sensitive data.

  This requirement applies to applications providing malicious code protection. Malicious code protection mechanisms include, but are not limited, to, anti-virus and malware detection software. Malicious code protection mechanisms (including signature definitions and rule sets) must be updated when new releases are available.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  & env:ExchangeInstallPath\Scripts\Disable-Antimalwarescanning.ps1

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-TransportAgent "Malware Agent"

  If the value of "Enabled" is set to "True", this is a finding.


vuln_id: V-221270
rule_id: SV-221270r961194_rule
severity: CAT II
title: The applications built-in Malware Agent must be disabled.
cci: CCI-001242
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Malicious code protection mechanisms include, but are not limited, to, anti-virus and malware detection software. In order to minimize potential negative impact to the organization that can be caused by malicious code, it is imperative that malicious code is identified and eradicated. 

  Malicious code includes viruses, worms, trojan horses, and spyware. It is not enough to simply have the software installed; this software must periodically scan the system to search for malware on an organization-defined frequency. 

  Exchange's built-in Malware Agent is not designed to address all malicious code protection workloads. This workload is best handled by third-party anti-virus and intrusion prevention software.

  Site must utilize an approved DoD scanner. Exchange Malware software has a limited scanning capability and does not scan files that are downloaded, opened, or executed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
[cell repeats an earlier one in this file: 134 characters]

check_text:
[cell repeats an earlier one in this file: 167 characters]


vuln_id: V-228354
rule_id: SV-228354r879526_rule
severity: CAT II
title: Exchange must have Administrator audit logging enabled.
cci: CCI-001403
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Unauthorized or malicious data changes can compromise the integrity and usefulness of the data. Automated attacks or malicious users with elevated privileges have the ability to effect change using the same mechanisms as email administrators. 

  Auditing any changes to access mechanisms not only supports accountability and nonrepudiation for those authorized to define the environment but also enables investigation of changes made by others who may not be authorized. 

  Note: This administrator auditing feature audits all exchange changes regardless of the user's assigned role or permissions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-AdminAuditLogConfig -AdminAuditLogEnabled $true

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-AdminAuditLogConfig | Select Name, AdminAuditLogEnabled

  If the value of "AdminAuditLogEnabled" is not set to "True", this is a finding.


vuln_id: V-228355
rule_id: SV-228355r879530_rule
severity: CAT II
title: Exchange servers must use approved DoD certificates.
fix_text: Remove the non-DoD certificate and import the correct DoD certificates.
cci: CCI-000213
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Server certificates are required for many security features in Exchange; without them, the server cannot engage in many forms of secure communication.

  Failure to implement valid certificates makes it virtually impossible to secure Exchange's communications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ExchangeCertificate | Select CertificateDomains, issuer

  If the value of "CertificateDomains" does not indicate it is issued by the DoD, this is a finding.


vuln_id: V-228356
rule_id: SV-228356r879533_rule
severity: CAT II
title: Exchange auto-forwarding email to remote domains must be disabled or restricted.
cci: CCI-001368
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Verify Automatic Forwards to remote domains are disabled, except for enterprise mail that must be restricted to forward only to .mil and .gov. domains.

  Before enabling this setting, configure a remote domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Non-Enterprise Mail Fix Text:

  Open the Exchange Management Shell and enter the following command:

  Set-RemoteDomain -Identity <'IdentityName'> -AutoForwardEnabled $false 

  Note: The <IdentityName> value must be in single quotes.

  Enterprise Mail Fix Text:

  New-RemoteDomain -Name <NewRemoteDomainName> -DomainName <SMTP Address>

  Note: <NewRemoteDomainName> must either be a .mil or .gov domain.

  Set-RemoteDomain -Identity <'RemoteDomainIdentity'> -AutoForwardEnabled $true

  Note: The <RemoteDomainIdentity> value must be in single quotes.

check_text:
  Note: Requirement is not applicable on classified or completely closed networks.

  Non-Enterprise Mail Check Content: 

  Open the Exchange Management Shell and enter the following command:

  Get-RemoteDomain | Select Identity, AutoForwardEnabled

  If the value of AutoForwardEnabled is not set to "False", this is a finding.

  Enterprise Mail Check Content:

  If the value of "AutoForwardEnabled" is set to "True", this is not a finding.

  and 

  In the Exchange Management Shell, enter the following command:

  Get-RemoteDomain

  If the value of "RemoteDomain" is not set to ".mil" and/or ".gov" domain(s), this is a finding.


vuln_id: V-228357
rule_id: SV-228357r879559_rule
severity: CAT II
title: Exchange Connectivity logging must be enabled.
cci: CCI-000169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A connectivity log is a record of the SMTP connection activity of the outbound message delivery queues to the destination Mailbox server, smart host, or domain. Connectivity logging is available on Hub Transport servers and Edge Transport servers. By default, connectivity logging is disabled. If events are not recorded, it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users.

  Note: Transport configuration settings apply to the organization/global level of the Exchange SMTP path. By checking and setting them at the Hub server, the setting will apply to both Hub and Edge roles.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-TransportService -Identity <'IdentityName'> -ConnectivityLogEnabled $true

  Note: The <IdentityName> value must be in single quotes.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-TransportService  | Select Name, Identity, ConnectivityLogEnabled 

  If the value of "ConnectivityLogEnabled" is not set to "True", this is a finding.


vuln_id: V-228358
rule_id: SV-228358r879559_rule
severity: CAT II
title: The Exchange Email Diagnostic log level must be set to the lowest level.
cci: CCI-000169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Diagnostic logging, however, characteristically produces large volumes of data and requires care in managing the logs to prevent risk of disk capacity denial-of-service conditions. 

  Exchange diagnostic logging is divided into 29 main "services", each of which has anywhere from 2 to 26 "categories" of events to be monitored. Each category may be set to one of four levels of logging: Lowest, Low, Medium, and High, depending on how much detail is required. Higher levels of detail require more disk space to store the audit material.

  Diagnostic logging is intended to help administrators debug problems with their systems, not as a general-purpose auditing tool. Because the diagnostic logs collect a great deal of information, the log files may grow large very quickly. Diagnostic log levels may be raised for limited periods of time when attempting to debug relevant pieces of Exchange functionality. Once debugging has finished, diagnostic log levels should be reduced again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-EventLogLevel -Identity <'IdentityName\EventlogName'> -Level Lowest

  Note: The <IdentityName\EventlogName> value must be in single quotes.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-EventLogLevel

  If the Diagnostic of any EventLevel is not set to "Lowest", this is a finding.


vuln_id: V-228359
rule_id: SV-228359r879559_rule
severity: CAT III
title: Exchange Audit record parameters must be set.
cci: CCI-000169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts. This item declares the fields that must be available in the audit log file in order to adequately research events that are logged. 

  Audit records should include the following fields to supply useful event accounting: 
  Object modified, Cmdlet name, Cmdlet parameters, Modified parameters, Caller, Succeeded, and Originating server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-AdminAuditLogConfig -AdminAuditLogParameters *

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-AdminAuditLogConfig | Select AdminAuditLogParameters

  Note: The value of "*" indicates all parameters are being audited.

  If the value of "AdminAuditLogParameters" is not set to "*", this is a finding.


vuln_id: V-228360
rule_id: SV-228360r879566_rule
severity: CAT III
title: Exchange Circular Logging must be disabled.
cci: CCI-000133
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Logging provides a history of events performed and can also provide evidence of tampering or attack. Failure to create and preserve logs adds to the risk that suspicious events may go unnoticed and raises the potential that insufficient history will be available to investigate them. 

  This setting controls how log files are written. If circular logging is enabled, one log file is stored with a default size of 1024 KB. Once the size limit has been reached, additional log entries overwrite the oldest log entries. If circular logging is disabled, once a log file reaches the size limit, a new log file is created. 

  Mailbox should not use circular logging. Logs should be written to a partition separate from the operating system, with log protection and backups being incorporated into the overall System Security Plan.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-MailboxDatabase -Identity <'IdentityName'> -CircularLoggingEnabled $false

  Note: The <IdentityName> value must be in single quotes.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-MailboxDatabase | Select Name, Identity, CircularLoggingEnabled

  If the value of "CircularLoggingEnabled" is not set to "False", this is a finding.


vuln_id: V-228361
rule_id: SV-228361r879566_rule
severity: CAT II
title: Exchange Email Subject Line logging must be disabled.
cci: CCI-000133
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. When "message tracking" is enabled, only the sender, recipients, time, and other delivery information is included by default. Information such as the subject and message body is not included.

  However, the absence of the message subject line can make it difficult to locate a specific message in the log unless one knows roughly what time the message was sent. To simplify searches through these logs, Exchange offers the ability to include the message "subject line" in the log files and in the Message Tracking Center display. This can make it significantly easier to locate a specific message.

  However, this feature creates larger log files and will contain information that may raise privacy and legal concerns. Enterprise policy should be consulted before this feature is enabled. Also, because the log files may contain sensitive information in the form of the subject line, the log files will need to be protected, commensurate with the sensitivity level, as the content may be of interest to an attacker.

  For these reasons, it is recommended that subject logging not be enabled during regular production operations. Instead, treat this feature as a diagnostic that can be used if needed. The tradeoff is that finding the correct message in the message tracking logs will become more difficult because the administrator will need to search using only the time the message was sent and the message’s sender. This control will have no effect unless Message Tracking is enabled. However, the setting should be disabled in case message tracking is enabled in the future.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-Transportservice -MessageTrackingLogSubjectLoggingEnabled $False

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-TransportService | Select Name, Identity, MessageTrackingLogSubjectLoggingEnabled

  If the value of “MessageTrackingLogSubjectLoggingEnabled” is not set to “False”, this is a finding.


vuln_id: V-228362
rule_id: SV-228362r879566_rule
severity: CAT II
title: Exchange Message Tracking Logging must be enabled.
cci: CCI-000133
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A message tracking log provides a detailed log of all message activity as messages are transferred to and from a computer running Exchange.

  If events are not recorded, it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-Transportservice <IdentityName> -MessageTrackingLogEnabled $true

  Note: The <IdentityName> value must be in quotes.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-Transportservice  | Select Name, MessageTrackingLogEnabled

  If the value of MessageTrackingLogEnabled is not set to True, this is a finding.


vuln_id: V-228363
rule_id: SV-228363r879572_rule
severity: CAT II
title: Exchange Queue monitoring must be configured with threshold and action.
cci: CCI-000154
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Monitors are automated "process watchers" that respond to performance changes and can be useful in detecting outages and alerting administrators where attention is needed. Exchange has built-in monitors that enable the administrator to generate alerts if thresholds are reached, better enabling them to react in a timely fashion.

  This field offers choices of alerts when a "warning" or "critical" threshold is reached on the SMTP queue. A good rule of thumb (default) is to issue warnings when SMTP queue growth exceeds 10 minutes and critical messages when it exceeds 20 minutes, which should only happen occasionally. Frequent alerts against this counter may indicate a network or other issue (such as inbound ExchangeMER traffic) that directly impacts email delivery.

  Notification choices include email alert to an email-enabled account (for example, an email Administrator) or invoke a script to take other action (for example, to add an Event to the Microsoft Application Event Log, where external monitors might detect it).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  perfmon

  In the left pane, navigate to and select Performance >> Data Collector Sets >> User Defined.

  Right-click on, navigate to, and configure User Defined >> New >> Data Collector Sets and configure the system to use the data collection set for monitoring the queues.

check_text:
  Note: If a third-party application is performing monitoring functions, the reviewer should verify the application is monitoring correctly and mark the vulnerability not applicable (NA).

  Open the Exchange Management Shell and enter the following command:

  perfmon
   Get-MonitoringItemHelp -Identity <String> -Server <ServerIdParameter>

  If no sets are defined or queues are not being monitored, this is a finding.


vuln_id: V-228364
rule_id: SV-228364r879587_rule
severity: CAT II
title: Exchange Send Fatal Errors to Microsoft must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

  Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).

  Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission but that cannot be disabled.

  All system errors in Exchange will result in outbound traffic that may be identified by an eavesdropper. For this reason, the "Report Fatal Errors to Microsoft" feature must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ExchangeServer -Identity <'IdentityName'> -ErrorReportingEnabled $false

  Note: The <IdentityName> value must be in single quotes.

  Repeat the process for each Exchange Server.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ExchangeServer –status | Select Name, Identity, ErrorReportingEnabled

  For each Exchange Server, if the value of "ErrorReportingEnabled" is not set to "False", this is a finding.


vuln_id: V-228365
rule_id: SV-228365r879576_rule
severity: CAT II
title: Exchange must protect audit data against unauthorized read access.
cci: CCI-000162
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive and in need of protection. Audit data available for modification by a malicious user can be altered to conceal malicious activity. Audit data might also provide a means for the malicious user to plan unauthorized activities that exploit weaknesses.

  The contents of audit logs are protected against unauthorized access, modification, or deletion. Only authorized auditors and the audit functions should be granted "Read" and "Write" access to audit log data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the authorized groups or users that should have "Read" access to the audit data or verify that this information is documented by the organization.

  Restrict any unauthorized groups' or users' "Read" access to the audit logs.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information. 

  Determine the authorized groups or users that should have "Read" access to the audit data.

  If any group or user has "Read" access to the audit data that is not documented in the EDSP, this is a finding.


vuln_id: V-228366
rule_id: SV-228366r879587_rule
severity: CAT II
title: Exchange must not send Customer Experience reports to Microsoft.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

  Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). 

  Examples of non-essential capabilities include, but are not limited to, advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission but that cannot be disabled.

  Customer Experience reports in Exchange will result in outbound traffic that may be identified by an eavesdropper. For this reason, the Customer Experience reports must not be sent to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-OrganizationConfig -CustomerFeedbackEnabled $false

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-OrganizationConfig | Select CustomerFeedbackEnabled 

  If the value for "CustomerFeedbackEnabled" is not set to "False", this is a finding.


vuln_id: V-228367
rule_id: SV-228367r879577_rule
severity: CAT II
title: Exchange must protect audit data against unauthorized access.
cci: CCI-000163
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive and in need of protection. Audit data available for modification by a malicious user can be altered to conceal malicious activity. Audit data might also provide a means for the malicious user to plan unauthorized activities that exploit weaknesses.

  The contents of audit logs are protected against unauthorized access, modification, or deletion. Only authorized auditors and the audit functions should be granted "Read" and "Write" access to audit log data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the authorized groups or users that should have access to the audit data or verify that this information is documented by the organization.

  Restrict any unauthorized groups' or users' modify permissions for the audit logs.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information. 

  Determine the authorized groups or users that should have access to the audit data.

  If any group or user has modify privileges for the audit data that is not documented in the EDSP, this is a finding.


vuln_id: V-228368
rule_id: SV-228368r879578_rule
severity: CAT II
title: Exchange must protect audit data against unauthorized deletion.
cci: CCI-000164
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive and in need of protection. Audit data available for modification by a malicious user can be altered to conceal malicious activity. Audit data might also provide a means for the malicious user to plan unauthorized activities that exploit weaknesses.

  The contents of audit logs are protected against unauthorized access, modification, or deletion. Only authorized auditors and the audit functions should be granted "Read" and "Write" access to audit log data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the authorized groups or users that should have "Delete" permissions for the audit data or verify that this information is documented by the organization.

  Restrict any unauthorized groups' or users' "Delete" permissions for the audit logs.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information.

  Determine the authorized groups or users that should have "Delete" permissions for the audit data.

  If any group or user has "Delete" permissions for the audit data that is not documented in the EDSP, this is a finding.


vuln_id: V-228369
rule_id: SV-228369r879582_rule
severity: CAT II
title: Exchange Audit data must be on separate partitions.
cci: CCI-001348
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Log files help establish a history of activities and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive and in need of protection.

  Successful exploit of an application server vulnerability may well be logged by monitoring or audit processes when it occurs. Writing log and audit data to a separate partition where separate security contexts protect them may offer the ability to protect this information from being modified or removed by the exploit mechanism.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the audit logs' assigned partition or verify that this information is documented by the organization.

  Configure the audit log location to be on a partition drive separate from the application.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information.

  Determine the audit logs' assigned partition.

  By default, the logs are located on the application partition in \Program Files\Microsoft\Exchange Server\V15\Logging.

  If the log files are not on a separate partition from the application, this is a finding.


vuln_id: V-228370
rule_id: SV-228370r879584_rule
severity: CAT II
title: Exchange Local machine policy must require signed scripts.
cci: CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Scripts often provide a way for attackers to infiltrate a system, especially scripts downloaded from untrusted locations. By setting machine policy to prevent unauthorized script executions, unanticipated system impacts can be avoided. Failure to allow only signed remote scripts reduces the attack vector vulnerabilities from unsigned remote scripts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ExecutionPolicy RemoteSigned

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ExecutionPolicy

  If the value returned is not "RemoteSigned", this is a finding.


vuln_id: V-228371
rule_id: SV-228371r944805_rule
severity: CAT II
title: The Exchange Internet Message Access Protocol 4 (IMAP4) service must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>IMAP4 is not approved for use within the DoD. It uses a clear-text-based user name and password and does not support the DoD standard for PKI for email access. User name and password could easily be captured from the network, allowing a malicious user to access other system features. Uninstalling or disabling the service will prevent the use of the IMAP4 protocol.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Windows Power Shell and enter the following command:

  services.msc

  Navigate to and double-click on "Microsoft Exchange IMAP4".

  Click on the "General" tab.

  In the "Startup Type" dropdown, select "Disabled".

  Click the "OK" button.

check_text:
  Note: This requirement applies to IMAP4. IMAP Secure is not restricted and does not apply to this requirement.

  Open the Windows Power Shell and enter the following command:

  Get-ItemProperty 'hklm:\system\currentcontrolset\services\MSExchangeIMAP4' | Select Start

  Note: The hklm:\system\currentcontrolset\services\MSExchangeIMAP4 value must be in single quotes.

  If the value of "Start" is not set to "4", this is a finding.


vuln_id: V-228372
rule_id: SV-228372r879587_rule
severity: CAT II
title: The Exchange Post Office Protocol 3 (POP3) service must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>POP3 is not approved for use within the DoD. It uses a clear-text-based user name and password and does not support the DoD standard for PKI for email access. User name and password could easily be captured from the network, allowing a malicious user to access other system features. Uninstalling or disabling the service will prevent the use of POP3.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Windows Power Shell and enter the following command:

  services.msc

  Navigate to and double-click on "Microsoft Exchange POP3 Backend".

  Click on the "General" tab.

  In the "Startup Type" dropdown, select "Disabled".

  Click the "OK" button.

check_text:
  Open the Windows Power Shell and enter the following command:

  Get-ItemProperty 'hklm:\system\currentcontrolset\services\MSExchangePOP3' | Select Start

  Note: The hklm:\system\currentcontrolset\services\MSExchangePOP3 value must be in single quotes.

  If the value of "Start" is not set to "4", this is a finding.


vuln_id: V-228373
rule_id: SV-228373r879631_rule
severity: CAT II
title: Exchange Mailbox databases must reside on a dedicated partition.
cci: CCI-001082
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>In the same way that added security layers can provide a cumulative positive effect on security posture, multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to the host system can most likely lead to a compromise of all applications hosted by the same system.

  Email services should be installed to a discrete set of directories on a partition that does not host other applications. Email services should never be installed on a Domain Controller/Directory Services server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the location where the Exchange Mailbox databases reside or verify that this information is documented by the organization.

  Configure the mailbox databases on a dedicated partition.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information.

  Determine the location where the Exchange Mailbox databases reside.

  Open the Exchange Management Shell and enter the following command:

  Get-MailboxDatabase | Select Name, Identity, EdbFilePath

  Open Windows Explorer, navigate to the mailbox databases, and verify they are on a dedicated partition.

  If the mailbox databases are not on a dedicated partition, this is a finding.


vuln_id: V-228374
rule_id: SV-228374r879633_rule
severity: CAT II
title: Exchange Internet-facing Send connectors must specify a Smart Host.
cci: CCI-001178
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>When identifying a "Smart Host" for the email environment, a logical Send connector is the preferred method.

  A Smart Host acts as an Internet-facing concentrator for other email servers. Appropriate hardening can be applied to the Smart Host, rather than at multiple locations throughout the enterprise.

  Failure to identify a Smart Host could default to each email server performing its own lookups (potentially through protective firewalls). Exchange servers should not be Internet facing and should therefore not perform any Smart Host functions. When the Exchange servers are Internet facing, they must be configured to identify the Internet-facing server that is performing the Smart Host function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SendConnector  -Identity <'IdentityName'> -SmartHosts <'IP Address of Smart Host'> -DNSRoutingEnabled $false

  Note: The <IdentityName> and <IP Address of Smart Host> values must be in single quotes.

  Repeat the procedure for each Send connector.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-SendConnector | Select Name, Identity, SmartHosts

  Identify the Internet-facing connectors. 

  For each Send connector, if the value of "SmartHosts" does not return the Smart Host IP address, this is a finding.


vuln_id: V-228375
rule_id: SV-228375r879636_rule
severity: CAT II
title: Exchange internal Receive connectors must require encryption.
cci: CCI-001184
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Simple Mail Transfer Protocol (SMTP) Receive connector is used by Exchange to send and receive messages from server to server using SMTP protocol. This setting controls the encryption strength used for client connections to the SMTP Receive connector. With this feature enabled, only clients capable of supporting secure communications will be able to send mail using this SMTP server. Where secure channels are required, encryption can also be selected. 

  The use of secure communication prevents eavesdroppers from reading or modifying communications between mail clients and servers. While sensitive message bodies should be encrypted by the sender at the client, requiring a secure connection from the client to the server adds protection by encrypting the sender and recipient information that cannot be encrypted by the sender.

  Individually, channel security and encryption have been compromised by attackers. Used together, email becomes a more difficult target, and security is heightened. Failure to enable this feature gives eavesdroppers an opportunity to read or modify messages between the client and server.
  Multiple values can be separated by commas, but some values have dependencies and exclusions. AuthMechanism may include other mechanisms as long as the "Tls" is identified.
  •	Only use the value "None" by itself.
  •	The value "BasicAuthRequireTLS" requires the values "BasicAuth" and "Tls".
  •	The only other value that can be used with ExternalAuthoritative is "Tls".
  •	The value "Tls" is required when the value of the RequireTLS parameter is "$true".
  •	The value "ExternalAuthoritative" requires the value of the PermissionGroups parameter be set to "ExchangeServers".
  </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -AuthMechanism 'Tls'

  Note: The <IdentityName> value must be in single quotes.

  Repeat the procedures for each Receive connector.

check_text:
  Note: AuthMechanism may include other mechanisms as long as the "Tls" is identified.

  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, AuthMechanism

  For each Receive connector, if the value of "AuthMechanism" is not set to "Tls", this is a finding.


vuln_id: V-228376
rule_id: SV-228376r879642_rule
severity: CAT II
title: Exchange Mailboxes must be retained until backups are complete.
cci: CCI-001199
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Backup and recovery procedures are an important part of overall system availability and integrity. Complete backups reduce the chance of accidental deletion of important information and make it possible to have complete recoveries.

  It is not uncommon for users to receive and delete messages in the scope of a single backup cycle. This setting ensures at least one backup has been run on the mailbox store before the message physically disappears. By enabling this setting, all messages written to recipients who have accounts on this store will reside in backups even if they have been deleted by the user before the backup has run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-MailboxDatabase  -Identity <'IdentityName'> -RetainDeletedItemsUntilBackup $true

  Note: The <IdentityName> value must be in single quotes.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-MailboxDatabase| Select Name, Identity, RetainDeletedItemsUntilBackup

  If the value of "RetainDeletedItemsUntilBackup" is not set to "True", this is a finding.


vuln_id: V-228377
rule_id: SV-228377r879642_rule
severity: CAT II
title: Exchange email forwarding must be restricted.
cci: CCI-001199
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Auto-forwarded email accounts do not meet the requirement for digital signature and encryption of Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII) in accordance with DoDI 8520.2 (reference ee) and DoD Director for Administration and Management memorandum, "Safeguarding Against and Responding to the Breach of Personally Identifiable Information".

  Use of forwarding set by an administrator interferes with nonrepudiation requirements that each end user be responsible for creation and destination of email data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP.

  Open the Exchange Management Shell and enter the following command:

  Set-Mailbox -Identity <'IdentityName'> -ForwardingSMTPAdddress $null

  Note: The <IdentityName> value must be in quotes.

check_text:
  Review the Email Domain Security Plan (EDSP).  

  Determine any accounts that have been authorized to have email auto-forwarded.

  Note: If email auto-forwarding is not being used, this check is not applicable. .

  Open the Exchange Management Shell and enter the following commands:

  Get-Mailbox | Select Name, Identity, Filter 

  If any user has a forwarding SMTP address and is not documented in the EDSP, this is a finding.

  Note: If no remote SMTP domain matching the mail-enabled user or contact that allows forwarding is configured for users identified with a forwarding address, this function will not work properly.


vuln_id: V-228378
rule_id: SV-228378r879642_rule
severity: CAT II
title: Exchange email-forwarding SMTP domains must be restricted.
cci: CCI-001199
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Auto-forwarded email accounts do not meet the requirement for digital signature and encryption of Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII) in accordance with DoDI 8520.2 (reference ee) and DoD Director for Administration and Management memorandum, "Safeguarding Against and Responding to the Breach of Personally Identifiable Information".

  Use of forwarding set by an administrator interferes with nonrepudiation requirements that each end user be responsible for creation and destination of email data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify any accounts that have been authorized to have email auto-forwarded or verify that this information is documented by the organization.

  Open the Exchange Management Shell and enter the following command:

  Set- RemoteDomain -Identity <RemoteDomainIdParameter>

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information. 

  Determine any accounts that have been authorized to have email auto-forwarded.

  Note: If email auto-forwarding is not being used, this check is not applicable (NA).

  Open the Exchange Management Shell and enter the following commands:

  Get-RemoteDomain | Select Name, Identity, DomainName, AutoForwardEnabled

  If any domain for a user forwarding SMTP address is not documented in the EDSP, this is a finding.

  Note: If no remote SMTP domain matching the mail-enabled user or contact that allows forwarding is configured for users identified with a forwarding address, this function will not work properly.


vuln_id: V-228379
rule_id: SV-228379r879650_rule
severity: CAT III
title: Exchange Mail quota settings must not restrict receiving mail.
cci: CCI-001094
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Mail quota settings control the maximum sizes of a user’s mailbox and the system’s response if these limits are exceeded. Mailbox data that is not monitored against a quota increases the risk of mail loss due to filled disk space, which can also render the system unavailable.

  Failure to allow mail receipt may impede users from receiving mission-critical data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-MailboxDatabase -Identity <'IdentityName'> -ProhibitSendReceiveQuota Unlimited

  Note: The <IdentityName> value must be in single quotes.

  or

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-MailboxDatabase | Select Name, Identity, ProhibitSendReceiveQuota

  If the value of "ProhibitSendReceiveQuota" is not set to "Unlimited", this is a finding.

  or

  If the value of "ProhibitSendReceiveQuota" is set to an alternate value and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-228380
rule_id: SV-228380r879650_rule
severity: CAT III
title: Exchange Mail Quota settings must not restrict receiving mail.
cci: CCI-001094
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Mail quota settings control the maximum sizes of a user’s mailbox and the system’s response if these limits are exceeded. Mailbox data that is not monitored against a quota increases the risk of mail loss due to filled disk space, which can also render the system unavailable. Multiple controls supply graduated levels of opportunity to respond before risking email service loss. 

  This control prohibits the user from sending an email when the mailbox limit reaches the prohibit send quota value.

  Note: Best practice for this setting is to prohibit the user from sending email when the mailbox reaches 90 percent of capacity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the value for the Prohibit Send Quota limit or verify that this information is documented by the organization.

  Open the Exchange Management Shell and enter the following command:

  Set-MailboxDatabase  -Identity <'IdentityName'> -ProhibitSendQuota <'QuotaLimit'>

  Note: The <IdentityName> and <QuotaLimit> values must be in single quotes.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information. 

  Determine the value for the Prohibit Send Quota limit.

  Open the Exchange Management Shell and enter the following command:

  Get-MailboxDatabase | Select Name, Identity, ProhibitSendQuota

  If the value of "ProhibitSendQuota" is not set to the site's Prohibit Send Quota limit, this is a finding.


vuln_id: V-228381
rule_id: SV-228381r879650_rule
severity: CAT III
title: Exchange Mailbox Stores must mount at startup.
cci: CCI-001094
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Administrator responsibilities include the ability to react to unplanned maintenance tasks or emergency situations that may require Mailbox data manipulation. Occasionally, there may be a need to start the server with "unmounted" data stores if manual maintenance is being performed on them. Failure to uncheck the "do not mount on startup" condition will result in unavailability of mail services. 

  Correct configuration of this control will prevent unplanned outages due to being enabled. When maintenance is being performed, care should be taken to clear the check box upon task completion so mail stores are available to users (unmounted mailbox stores are not available to users).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-MailboxDatabase -Identity <'IdentityName'> -MountAtStartup $true

  Note: The <IdentityName> value must be in single quotes.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-MailboxDatabase | Select Name, Identity, MountAtStartup

  If the value of "MountAtStartup" is not set to "True", this is a finding.


vuln_id: V-228382
rule_id: SV-228382r879651_rule
severity: CAT III
title: Exchange Message size restrictions must be controlled on Receive connectors.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. For message size restrictions, multiple places exist to set or override inbound or outbound message size. Failure to control the configuration strategy can result in loss of data or system availability. 

  This setting enables the administrator to control the maximum message size on receive connectors. Using connectors to control size limits may necessitate applying message size limitations in multiple places, with the potential of introducing conflicts and impediments in the mail flow. Changing this setting at the connector overrides the global one. Therefore, if operational needs require it, the connector value may be set lower than the global value with the rationale documented in the Email Domain Security Plan (EDSP).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the global maximum message receive size and, if operationally necessary, to document signoff with risk acceptance for the Receive connector to have a different value, or verify that this information is documented by the organization.

  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -MaxMessageSize <'MaxReceiveSize'>

  Note: The <IdentityName> and <MaxReceiveSize> values must be in single quotes.

  or

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

  Repeat the procedure for each Receive connector.

check_text:
  Review the EDSP or document that contains this information.

  Determine the global maximum message receive size and whether signoff with risk acceptance is documented for the Receive connector to have a different value.

  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, MaxMessageSize 

  Identify Internet-facing connectors. 

  For each Receive connector, if the value of "MaxMessageSize" is not the same as the global value, this is a finding.

  or

  If "MaxMessageSize" is set to a numeric value different from the global value and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-228383
rule_id: SV-228383r879651_rule
severity: CAT III
title: Exchange Receive connectors must control the number of recipients per message.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. 

  This configuration controls the maximum number of recipients who will receive a copy of a message at one time. This tunable value is related to throughput capacity and can enable the ability to optimize message delivery. 

  Note: There are two types of default Receive connecters:

  Client Servername: Accepts SMTP connections from all non-MAPI clients, such as POP and IMAP. As POP and IMAP are not authorized for use in DoD, these should not be present. Their default value for "MaxRecipientsPerMessage" is "200".

  Default Servername: Accepts connections from other Hub Transport servers and any Edge Transport servers. Their default value for "MaxRecipientsPerMessage" is "5000".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the "MaxRecipientsPerMessage" value or verify that this information is documented by the organization.

  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -MaxRecipientsPerMessage 5000 

  Note: The <IdentityName> value must be in single quotes.

  or 

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

  Repeat the procedure for each Receive connector.

check_text:
  Note: This requirement applies to IMAP4. IMAP Secure is not restricted and does not apply to this requirement.

  Review the Email Domain Security Plan (EDSP) or document that contains this information. 

  Determine the Maximum Recipients per Message value.

  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, MaxRecipientsPerMessage

  For each Receive connector, evaluate the "MaxRecipientsPerMessage" value.

  For each Receive connector, if the value of "MaxRecipientsPerMessage" is not set to "5000", this is a finding.

  or

  If the value of "MaxRecipientsPerMessage" is set to a value other than "5000" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-228384
rule_id: SV-228384r879651_rule
severity: CAT III
title: The Exchange Receive Connector Maximum Hop Count must be 60.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. This setting controls the maximum number of hops (email servers traversed) a message may take as it travels to its destination. Part of the original Internet protocol implementation, the hop count limit prevents a message being passed in a routing loop indefinitely. Messages exceeding the maximum hop count are discarded undelivered. 

  Recent studies indicate that virtually all messages can be delivered in fewer than 60 hops. If the hop count is set too low, messages may expire before they reach their destinations. If the hop count is set too high, an undeliverable message may cycle between servers, raising the risk of network congestion.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the "MaxHopCount" value or verify that this information is documented by the organization.

  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -MaxHopCount 60

  or 

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

  Repeat the procedure for each Receive connector.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information. 

  Determine the Max Hop Count value for Receive connectors.

  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, MaxHopCount

  For each Receive connector, if the value of "MaxHopCount" is not set to "60", this is a finding.

  or

  If the value of "MaxHopCount" is set to a value other than "60" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-228385
rule_id: SV-228385r879651_rule
severity: CAT III
title: Exchange Message size restrictions must be controlled on Send connectors.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. For message size restrictions, multiple places exist to set or override inbound or outbound message size. Failure to control the configuration strategy can result in loss of data or system availability. 

  This setting enables the administrator to control the maximum message size on a Send connector. Using connectors to control size limits may necessitate applying message size limitations in multiple places, with the potential of introducing conflicts and impediments in the mail flow. Changing this setting at the connector overrides the global one. Therefore, if operational needs require it, the connector value may be set lower than the global value with the rationale documented in the Email Domain Security Plan (EDSP).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the "MaxMessageSize" value or verify that this information is documented by the organization.

  Open the Exchange Management Shell and enter the following command:

  Set-SendConnector -Identity <'IdentityName'> -MaxMessageSize <MaxSendSize>

  Note: The <IdentityName> value must be in single quotes.

  or

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

  Repeat the procedures for each Send connector.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information. 

  Determine the maximum message send size.

  Open the Exchange Management Shell and enter the following command:

  Get-SendConnector | Select Name, Identity, MaxMessageSize

  For each Send connector, if the value of "MaxMessageSize" is not the same as the global value, this is a finding.

  or

  If "MaxMessageSize" is set to a numeric value different from the maximum message send size value documented in the EDSP, this is a finding.


vuln_id: V-228386
rule_id: SV-228386r879651_rule
severity: CAT III
title: The Exchange Send connector connections count must be limited.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Exchange Send connector setting controls the maximum number of simultaneous outbound connections allowed for a given SMTP connector and can be used to throttle the SMTP service if resource constraints warrant it. If the limit is too low, connections may be dropped. If the limit is too high, some domains may use a disproportionate resource share, denying access to other domains. Appropriate tuning reduces risk of data delay or loss.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the "MaxOutboundConnections" value.

  Open the Exchange Management Shell and enter the following command:

  Set-TransportServer -Identity <'IdentityName'> -MaxOutboundConnections 1000

  Note: The <IdentityName> value must be in single quotes.

  or

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the value for SMTP Server Maximum Outbound Connections.

  Open the Exchange Management Shell and enter the following command:

  Get-TransportService | Select Name, Identity, MaxOutboundConnections

  If the value of "MaxOutboundConnections" is not set to "1000", this is a finding.

  or

  If "MaxOutboundConnections" is set to a value other than "1000" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-228387
rule_id: SV-228387r879651_rule
severity: CAT III
title: The Exchange global inbound message size must be controlled.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. Message size limits should be set to 10 megabytes (MB) at most but often are smaller, depending on the organization. The key point in message size is that it should be set globally and should not be set to "unlimited". Selecting "unlimited" on "MaxReceiveSize" is likely to result in abuse and can contribute to excessive server disk space consumption. 

  Message size limits may also be applied on SMTP connectors, Public Folders, and on the user account under Active Directory (AD). Changes at these lower levels are discouraged, as the single global setting is usually sufficient. This practice prevents conflicts that could impact availability and simplifies server administration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the "MaxReceiveSize" value or verify that this information is documented by the organization.

  Open the Exchange Management Shell and enter the following command:

  Set-TransportConfig -MaxReceiveSize 10MB

  or

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information. 

  Determine the global maximum message receive size. 

  Open the Exchange Management Shell and enter the following command:

  Get-TransportConfig | Select Name, Identity, MaxReceiveSize

  If the value of "MaxReceiveSize" is not set to "10MB", this is a finding.

  or

  If "MaxReceiveSize" is set to an alternate value and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-228388
rule_id: SV-228388r879651_rule
severity: CAT III
title: The Exchange global outbound message size must be controlled.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. Message size limits should be set to 10 megabytes (MB) at most but often are smaller, depending on the organization. The key point in message size is that it should be set globally and should not be set to "unlimited". Selecting "unlimited" on "MaxReceiveSize" is likely to result in abuse and can contribute to excessive server disk space consumption. 

  Message size limits may also be applied on send and receive connectors, Public Folders, and on the user account under Active Directory (AD). Changes at these lower levels are discouraged, as the single global setting is usually sufficient. This practice prevents conflicts that could impact availability and simplifies server administration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the "MaxSendSize" value or verify that this information is documented by the organization.

  Open the Exchange Management Shell and enter the following command:

  Set-TransportConfig  -MaxSendSize 10MB

  or

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information.

  Determine the global maximum message send size. 

  Open the Exchange Management Shell and enter the following command:

  Get-TransportConfig | Select Name, Identity, MaxSendSize

  If the value of "MaxSendSize" is not set to "10MB", this is a finding.

  or

  If "MaxSendSize" is set to an alternate value and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-228389
rule_id: SV-228389r879651_rule
severity: CAT III
title: The Exchange Outbound Connection Limit per Domain Count must be controlled.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. This configuration controls the maximum number of simultaneous outbound connections from a domain as a delivery tuning mechanism. If the limit is too low, connections may be dropped. If the limit is too high, some domains may use a disproportionate resource share, denying access to other domains. Appropriate tuning reduces risk of data delay or loss. 

  By default, a limit of 20 simultaneous outbound connections from a domain should be sufficient. The value may be adjusted if justified by local site conditions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the "MaxPerDomainOutboundConnection" value or verify that this information is documented by the organization.

  Open the Exchange Management Shell and enter the following command:

  Set-TransportService -Identity <'IdentityName'> -MaxPerDomainOutboundConnections 20

  Note: The <IdentityName> value must be in single quotes.

  or

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information.

  Determine the value for Maximum Outbound Domain Connections.

  Open the Exchange Management Shell and enter the following command:

  Get-TransportService | Select Name, Identity, MaxPerDomainOutboundConnections

  If the value of "MaxPerDomainOutboundConnections" is not set to "20", this is a finding.

  or

  If "MaxPerDomainOutboundConnections" is set to a value other than "20" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-228390
rule_id: SV-228390r879651_rule
severity: CAT III
title: The Exchange Outbound Connection Timeout must be 10 minutes or less.
cci: CCI-001095
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. This configuration controls the number of idle minutes before the connection is dropped. It works in conjunction with the Maximum Outbound Connections Count setting.

  Connections, once established, may incur delays in message transfer. The default of 10 minutes is a reasonable window in which to resume activities without maintaining idle connections for excessive intervals. If the timeout period is too long, idle connections may be maintained for unnecessarily long time periods, preventing new connections from being established. Sluggish connectivity increases the risk of lost data. A value of "10" or less is optimal.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the "ConnectionInactivityTimeOut" value.

  Open the Exchange Management Shell and enter the following command:

  Set-SendConnector -Identity <'IdentityName'> -ConnectionInactivityTimeOut  00:10:00

  Note: The <IdentityName> value must be in single quotes.

  or

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information.

  Determine the Connection Timeout value.

  Open the Exchange Management Shell and enter the following command:

  Get-SendConnector | Select Name, Identity, ConnectionInactivityTimeOut 

  For each Send connector, if the value of "ConnectionInactivityTimeOut" is not set to "00:10:00", this is a finding.

  or

  If "ConnectionInactivityTimeOut" is set to a value other than "00:10:00" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-228391
rule_id: SV-228391r879653_rule
severity: CAT II
title: Exchange Internal Receive connectors must not allow anonymous connections.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This control is used to limit the servers that may use this server as a relay. If a Simple Mail Transport Protocol (SMTP) sender does not have a direct connection to the Internet (for example, an application that produces reports to be emailed), it will need to use an SMTP Receive connector that does have a path to the Internet (for example, a local email server) as a relay.

  SMTP relay functions must be protected so third parties are not able to hijack a relay service for their own purposes. Most commonly, hijacking of relays is done by spammers to disguise the source of their messages and may also be used to cover the source of more destructive attacks.
   
  Relays can be restricted in one of three ways: by blocking relays (restrict to a blank list of servers), by restricting use to lists of valid servers, or by restricting use to servers that can authenticate. Because authenticated connections are the most secure for SMTP Receive connectors, it is recommended that relays allow only servers that can authenticate.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -PermissionGroups and enter a valid value user group. 

  Note: The <IdentityName> value must be in single quotes.

  Example: Set-ReceiveConnector -Identity <'IdentityName'> -PermissionGroups ExchangeUsers

  Repeat the procedures for each Receive connector.

check_text:
  NOTE: In some instances, AnonymousUsers may be necessary for organization-specific operations. In such cases, allowing AnonymousUsers must be paired with restricting to specific lists of servers allowed to access. In addition, the risk must be documented and accepted by the ISSO, ISSM, or AO.
  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, PermissionGroups

  For each Receive connector, if the value of "PermissionGroups" is "AnonymousUsers" for any receive connector, this is a finding.


vuln_id: V-228392
rule_id: SV-228392r879653_rule
severity: CAT II
title: Exchange external/Internet-bound automated response messages must be disabled.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Spam originators, in an effort to refine mailing lists, sometimes monitor transmissions for automated bounce-back messages. Automated messages include such items as "Out of Office" responses, nondelivery messages, and automated message forwarding.

  Automated bounce-back messages can be used by a third party to determine if users exist on the server. This can result in the disclosure of active user accounts to third parties, paving the way for possible future attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-RemoteDomain -Identity <'IdentityName'> -AllowedOOFType 'InternalLegacy'

  Note: The <IdentityName> and InternalLegacy values must be in single quotes.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-RemoteDomain  | Select Name, DomainName, Identity, AllowedOOFType

  If the value of "AllowedOOFType" is not set to "InternalLegacy", this is a finding.


vuln_id: V-228393
rule_id: SV-228393r879653_rule
severity: CAT II
title: Exchange must have anti-spam filtering installed.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Originators of spam messages are constantly changing their techniques in order to defeat spam countermeasures; therefore, spam software must be constantly updated to address the changing threat. A manual update procedure is labor intensive and does not scale well in an enterprise environment. This risk may be mitigated by using an automatic update capability. Spam protection mechanisms include, for example, signature definitions, rule sets, and algorithms.

  Exchange 2016 provides both anti-spam and anti-malware protection out of the box. The Exchange 2016 anti-spam and anti-malware product capabilities are limited but still provide some protection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP with the anti-spam mechanism used.

  Install the AntiSpam module. 

  Open the Exchange Management Shell and enter the following command:

  & $env:ExchangeInstallPath\Scripts\Install-AntiSpamAgents.ps1

check_text:
  Review the Email Domain Security Plan (EDSP).

  Note: If using another DoD-approved antispam product for email or a DoD-approved email gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable (NA).

  Open the Exchange Management Shell and enter the following command:

  Get-ContentFilterConfig | Format-Table Name,Enabled

  If no value is returned, this is a finding.


vuln_id: V-228394
rule_id: SV-228394r879653_rule
severity: CAT II
title: Exchange must have anti-spam filtering enabled.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Originators of spam messages are constantly changing their techniques in order to defeat spam countermeasures; therefore, spam software must be constantly updated to address the changing threat. A manual update procedure is labor intensive and does not scale well in an enterprise environment. This risk may be mitigated by using an automatic update capability. Spam protection mechanisms include, for example, signature definitions, rule sets, and algorithms.

  Exchange 2016 provides both anti-spam and anti-malware protection out of the box. The Exchange 2016 anti-spam and anti-malware product capabilities are limited but still provide some protection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP with the anti-spam mechanism used.

  Open the Exchange Management Shell and enter the following command for any values that were not set to "True":

  Set-ContentFilterConfig -Enabled $true

  Set-SenderFilterConfig -Enabled $true

  Set-SenderIDConfig -Enabled $true

  Set-SenderReputationConfig -Enabled $true

check_text:
  Review the Email Domain Security Plan (EDSP).

  Note: If using another DoD-approved anti-spam product for email or a DoD-approved email gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable (NA).

  Open the Exchange Management Shell and enter the following command:

  Get-ContentFilterConfig | Format-Table Name,Enabled; Get-SenderFilterConfig | Format-Table Name,Enabled; Get-SenderIDConfig | Format-Table Name,Enabled; Get-SenderReputationConfig | Format-Table Name,Enabled

  If any of the following values returned are not set to "True", this is a finding:

  Set-ContentFilterConfig 
  Set-SenderFilterConfig 
  Set-SenderIDConfig
  Set-SenderReputationConfig


vuln_id: V-228395
rule_id: SV-228395r879653_rule
severity: CAT II
title: Exchange must have anti-spam filtering configured.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Originators of spam messages are constantly changing their techniques in order to defeat spam countermeasures; therefore, spam software must be constantly updated to address the changing threat. A manual update procedure is labor intensive and does not scale well in an enterprise environment. This risk may be mitigated by using an automatic update capability. Spam protection mechanisms include, for example, signature definitions, rule sets, and algorithms.

  Exchange 2016 provides both anti-spam and anti-malware protection out of the box. The Exchange 2016 anti-spam and anti-malware product capabilities are limited but still provide some protection.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Note: Configure the IP addresses of every internal SMTP server. If the Mailbox server is the only SMTP server running the antispam agents, configure the IP address of the Mailbox server. 

  Update the EDSP with the anti-spam mechanism used.

  Open the Exchange Management Shell and enter the following command:

  Single SMTP server address:

  Set-TransportConfig -InternalSMTPServers @{Add='<ip address1>'}

  Multiple SMTP server addresses:

  Set-TransportConfig -InternalSMTPServers @{Add='<ip address1>','<ip address2>'}

check_text:
  Review the Email Domain Security Plan (EDSP).

  Note: If using another DoD-approved antispam product for email or a DoD-approved email gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable (NA).

  Determine the internal SMTP servers. 

  Open the Exchange Management Shell and enter the following command:

  Get-TransportConfig | Format-List InternalSMTPServers

  If any internal SMTP server IP address returned does not reflect the list of accepted SMTP server IP addresses, this is a finding.


vuln_id: V-228396
rule_id: SV-228396r879653_rule
severity: CAT II
title: Exchange must not send automated replies to remote domains.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Remote users will not receive automated "Out of Office" delivery reports. This setting can be used to determine if all the servers in the organization can send "Out of Office" messages.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-RemoteDomain -Identity <'IdentityName'> -AutoReplyEnabled $false

  Note: The <IdentityName> value must be in single quotes.

check_text:
  Note: Automated replies to .MIL or .GOV sites are allowed.

  Open the Exchange Management Shell and enter the following command:

  Get-RemoteDomain | Select Name, Identity, AutoReplyEnabled
  If the value of “AutoReplyEnabled” is set to “True” and is configured to only Reply to .MIL or .GOV sites, this is not a finding.

  If the value of "AutoReplyEnabled" is not set to "False", this is a finding.


vuln_id: V-228397
rule_id: SV-228397r879653_rule
severity: CAT I
title: Exchange servers must have an approved DoD email-aware virus protection software installed.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>With the proliferation of trojans, viruses, and spam attaching themselves to email messages (or attachments), it is necessary to have capable email-aware anti-virus (AV) products to scan messages and identify any resident malware. Because email messages and their attachments are formatted to the MIME standard, a flat-file AV scanning engine is not suitable for scanning email message stores. 

  Email-aware anti-virus engines must be Exchange 2016 compliant. Competent email scanners will have the ability to scan mail stores, attachments (including zip or other archive files) and mail queues and to issue warnings or alerts if malware is detected. As with other AV products, a necessary feature to include is the ability for automatic updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the organization's anti-virus strategy.

  Install and configure a DoD-approved compatible Exchange 2016 email-aware anti-virus scanner product.

check_text:
  Review the Email Domain Security Plan (EDSP). 

  Determine the anti-virus strategy. 

  Verify the email-aware anti-virus scanner product is Exchange 2016 compatible and DoD approved. 

  If email servers are using an email-aware anti-virus scanner product that is not DoD approved and Exchange 2016 compatible, this is a finding.


vuln_id: V-228398
rule_id: SV-228398r879653_rule
severity: CAT III
title: The Exchange Global Recipient Count Limit must be set.
cci: CCI-001308
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning configurations. The Global Recipient Count Limit field is used to control the maximum number of recipients that can be specified in a single message sent from this server. Its primary purpose is to minimize the chance of an internal sender spamming other recipients, since spam messages often have a large number of recipients. Spam prevention can originate from both outside and inside organizations. While inbound spam is evaluated as it arrives, controls such as this one help prevent spam that might originate inside the organization. 

  The Recipient Count Limit is global to the Exchange implementation. Lower-level refinements are possible; however, in this configuration strategy, setting the value once at the global level facilitates a more available system by eliminating potential conflicts among multiple settings. A value of less than or equal to "5000" is probably larger than is needed for most organizations but is small enough to minimize usefulness to spammers and is easily handled by Exchange. An unexpanded distribution is handled as one recipient. Specifying "unlimited" may result in abuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the global maximum message recipient count.

  Set-TransportConfig -MaxRecipientEnvelopeLimit 5000

  or

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

  Restart the Microsoft Exchange Information Store service.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine the global maximum message recipient count. 

  Open the Exchange Management Shell and enter the following command:

  Get-TransportConfig | Select Name, Identity, MaxRecipientEnvelopeLimit

  If the value of "MaxRecipientEnvelopeLimit" is not set to "5000", this is a finding.

  or

  If "MaxRecipientEnvelopeLimit" is set to an alternate value and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-228399
rule_id: SV-228399r879673_rule
severity: CAT III
title: The Exchange Receive connector timeout must be limited.
cci: CCI-002361
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Email system availability depends in part on best practice strategies for setting tuning. This configuration controls the number of idle minutes before the connection is dropped. It works in conjunction with the Maximum Inbound Connections Count setting. 

  Connections, once established, may incur delays in message transfer. If the timeout period is too long, there is risk that idle connections may be maintained for unnecessarily long time periods, preventing new connections from being established.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the Connection Timeout value.

  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -ConnectionTimeout 00:10:00

  Note: The <IdentityName> value must be in single quotes.

  or 

  Enter the value as identified by the EDSP that has obtained a signoff with risk acceptance.

check_text:
  Review the Email Domain Security Plan (EDSP). 

  Determine the Connection Timeout value. 

  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, ConnectionTimeout

  For each Receive connector, if the value of "ConnectionTimeout" is not set to "00:10:00", this is a finding.

  or

  If "ConnectionTimeout" is set to other than "00:10:00" and has signoff and risk acceptance in the EDSP, this is not a finding.


vuln_id: V-228400
rule_id: SV-228400r879751_rule
severity: CAT II
title: The Exchange application directory must be protected from unauthorized access.
cci: CCI-001812
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Default product installations may provide more generous access permissions than are necessary to run the application. By examining and tailoring access permissions to more closely provide the least amount of privilege possible, attack vectors that align with user permissions are less likely to access more highly secured areas.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the authorized groups and users that have access to the Exchange application directories or verify that this information is documented by the organization.

  Navigate to the Exchange application directory and remove or modify the group or user access permissions. 

  Note: The default installation directory is \Program Files\Microsoft\Exchange Server\V15.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information.

  Determine the authorized groups and users that have access to the Exchange application directories.

  Verify the access permissions on the directory match the access permissions listed in the EDSP. 

  If any group or user has different access permissions, this is a finding. 

  Note: The default installation directory is \Program Files\Microsoft\Exchange Server\V15.


vuln_id: V-228401
rule_id: SV-228401r879753_rule
severity: CAT II
title: An Exchange software baseline copy must exist.
cci: CCI-001813
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Exchange software, as with other application software installed on a host system, must be included in a system baseline record and periodically reviewed; otherwise, unauthorized changes to the software may not be discovered. This effort is a vital step to securing the host and the applications, as it is the only method that may provide the ability to detect and recover from otherwise undetected changes, such as those that result from worm or bot intrusions. 

  The Exchange software and configuration baseline is created and maintained for comparison during scanning efforts. Operational procedures must include baseline updates as part of configuration management tasks that change the software and configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the software baseline, procedures, and implementation artifacts or verify that this information is documented by the organization.

check_text:
  Review the Email Domain Security Plan (EDSP) or document that contains this information.

  Determine the software baseline.

  Review the application software baseline procedures and implementation artifacts. 

  Note the list of files and directories included in the baseline procedure for completeness. 

  If an email software copy exists to serve as a baseline and is available for comparison during scanning efforts, this is not a finding.


vuln_id: V-228402
rule_id: SV-228402r928977_rule
severity: CAT II
title: Exchange software must be monitored for unauthorized changes.
cci: CCI-001814
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Monitoring software files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify that the organization monitors system files on servers for unauthorized changes against a baseline on a weekly basis or verify that this information is documented by the organization.

  Monitor the software files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on Exchange servers for unauthorized changes against a baseline on a weekly basis. 

  Note: This can be done with the use of various monitoring tools.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine whether the site monitors system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis. 

  If software files are not monitored for unauthorized changes, this is a finding.


vuln_id: V-228403
rule_id: SV-228403r879756_rule
severity: CAT II
title: Exchange services must be documented and unnecessary services must be removed or disabled.
cci: CCI-001762
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Unneeded but running services offer attackers an enhanced attack profile, and attackers are constantly watching to discover open ports with running services. By analyzing and disabling unneeded services, the associated open ports become unresponsive to outside queries, and servers become more secure as a result.
   
  Exchange Server has role-based server deployment to enable protocol path control and logical separation of network traffic types.

  For example, a server implemented in the Client Access role (i.e., Outlook Web App [OWA]) is configured and tuned as a web server using web protocols. A client access server exposes only web protocols (HTTP/HTTPS), enabling system administrators to optimize the protocol path and disable all services unnecessary for Exchange web services. Similarly, servers created to host mailboxes are dedicated to that task and must operate only the services needed for mailbox hosting. (Exchange servers must also operate some web services, but only to the degree that Exchange requires the IIS engine in order to function).

  Because Post Office Protocol 3 (POP3) and Internet Message Access Protocol 4 (IMAP4) clients are not included in the standard desktop offering, they must be disabled. While IMAP4 is restricted, IMAP Secure is not restricted and does not apply to this requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify the services required for the system to function. 

  Remove or disable any services that are not required.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Note: Required services will vary among organizations and will vary depending on the role of the individual system. Organizations will develop their own list of services, which will be documented and justified with the Information System Security Officer (ISSO). The site’s list will be provided for any security review. Services that are common to multiple systems can be addressed in one document. Exceptions for individual systems should be identified separately by system.

  Open a Windows PowerShell and enter the following command:

  Get-Service | Where-Object {$_.status -eq 'running'}

  Note: The command returns a list of installed services and the status of that service. 

  If the services required are not documented in the EDSP, this is a finding.

  If any undocumented or unnecessary services are running, this is a finding.


vuln_id: V-228404
rule_id: SV-228404r879764_rule
severity: CAT II
title: Exchange Outlook Anywhere clients must use NTLM authentication to access email.
cci: CCI-001953
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Identification and authentication provide the foundation for access control. Access to email services applications require NTLM authentication. Outlook Anywhere, if authorized for use by the site, must use NTLM authentication when accessing email.

  Note: There is a technical restriction in Exchange Outlook Anywhere that requires a direct SSL connection from Outlook to the Certificate Authority (CA) server. There is also a constraint where Microsoft supports that the CA server must participate in the Active Director (AD) domain inside the enclave. For this reason, Outlook Anywhere must be deployed only for enclave-sourced Outlook users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  For InternalClientAuthenticationMethod:

  Set-OutlookAnywhere -Identity '<IdentityName'> -InternalClientAuthenticationMethod NTLM

  For ExternalClientAuthenticationMethod:

  Set-OutlookAnywhere -Identity '<IdentityName'> -ExternalClientAuthenticationMethod NTLM

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-OutlookAnywhere

  Get-OutlookAnywhere | Select Name, Identity, InternalClientAuthenticationMethod, ExternalClientAuthenticationMethod

  If the value of "InternalClientAuthenticationMethod" and the value of "ExternalClientAuthenticationMethod" are not set to NTLM, this is a finding.


vuln_id: V-228405
rule_id: SV-228405r879802_rule
severity: CAT II
title: The Exchange Email application must not share a partition with another application.
cci: CCI-002530
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>In the same way that added security layers can provide a cumulative positive effect on security posture, multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to the host system can most likely lead to a compromise of all applications hosted by the same system.

  Email services should be installed on a partition that does not host other applications. Email services should never be installed on a Domain Controller/Directory Services server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP with the location of where Exchange is installed.

  Install Exchange on a dedicated application directory or partition separate than that of the operating system.

check_text:
  Review the Email Domain Security Plan (EDSP).

  Determine if the directory Exchange is installed.

  Open Windows Explorer.

  Navigate to where Exchange is installed. 

  If Exchange resides on a directory or partition other than that of the operating system and does not have other applications installed (unless approved by the Information System Security Officer [ISSO]), this is not a finding.


vuln_id: V-228406
rule_id: SV-228406r879806_rule
severity: CAT II
title: Exchange must not send delivery reports to remote domains.
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Ensure that delivery reports to remote domains are disabled. Before enabling this setting, first configure a remote domain using the Exchange Management Console (EMC) or the New-RemoteDomain cmdlet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-RemoteDomain -Identity <'IdentityName'> -DeliveryReportEnabled $false

  Note: The <IdentityName> value must be in single quotes.

check_text:
  Open the Exchange Management Shell and enter the following command:
   
  Get-RemoteDomain | Select Identity, DeliveryReportEnabled

  If the value of "DeliveryReportEnabled" is not set to "False", this is a finding.


vuln_id: V-228407
rule_id: SV-228407r879806_rule
severity: CAT II
title: Exchange must not send nondelivery reports to remote domains.
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Ensure that nondelivery reports to remote domains are disabled. Before enabling this setting, first configure a remote domain using the Exchange Management Console (EMC) or the New-RemoteDomain cmdlet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-RemoteDomain -Identity <'IdentityName'> -NDREnabled $false

  Note: The <IdentityName> value must be in single quotes.

check_text:
  NOTE: For the purpose of this requirement, “remote” refers to those domains external to the DoDIN, whether classified or unclassified. NDRs between DoDIN networks is permitted.

  Open the Exchange Management Shell and enter the following command:

  Get-RemoteDomain | Select Name, Identity, NDREnabled

  If the value of "NDREnabled" is not set to "False", this is a finding.


vuln_id: V-228408
rule_id: SV-228408r879806_rule
severity: CAT II
title: The Exchange SMTP automated banner response must not reveal server details.
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Automated connection responses occur as a result of FTP or Telnet connections when connecting to those services. They report a successful connection by greeting the connecting client and stating the name, release level, and (often) additional information regarding the responding product. While useful to the connecting client, connection responses can also be used by a third party to determine operating system or product release levels on the target server. The result can include disclosure of configuration information to third parties, paving the way for possible future attacks. For example, when querying the SMTP service on port 25, the default response looks similar to this one: 

  220 exchange.mydomain.org Microsoft ESMTP MAIL Service, Version: 6.0.3790.211 ready at Wed, 2 Feb 2005 23:40:00 -0500

  Changing the response to hide local configuration details reduces the attack profile of the target.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-ReceiveConnector -Identity <'IdentityName'> -Banner '220 SMTP Server Ready'

  Note: The <IdentityName> and 220 SMTP Server Ready values must be in single quotes.

  Repeat the procedures for each Receive connector.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-ReceiveConnector | Select Name, Identity, Banner

  For each Receive connector, if the value of "Banner" is not set to "220 SMTP Server Ready", this is a finding.


vuln_id: V-228409
rule_id: SV-228409r879806_rule
severity: CAT II
title: Exchange Internal Send connectors must use an authentication level.
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The Simple Mail Transfer Protocol (SMTP) connector is used by Exchange to send and receive messages from server to server. Several controls work together to provide security between internal servers. This setting controls the encryption method used for communications between servers. With this feature enabled, only servers capable of supporting Transport Layer Security (TLS) will be able to send and receive mail within the domain.

  The use of secure communication prevents eavesdroppers from reading or modifying communications between mail clients and servers. While sensitive message bodies should be encrypted by the sender at the client, requiring a secure connection from server to server adds protection by encrypting the sender and recipient information that cannot be encrypted by the sender. 

  Individually, channel security and encryption can be compromised by attackers. Used together, email becomes a more difficult target, and security is heightened. Failure to enable this feature gives eavesdroppers an opportunity to read or modify messages between servers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-SendConnector -Identity <'IdentityName'> -TlsAuthLevel DomainValidation

  Note: The <IdentityName> value must be in single quotes.

  Repeat the procedure for each Send connector.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-SendConnector | Select Name, Identity, TlsAuthLevel

  For each Send connector, if the value of "TlsAuthLevel" is not set to "DomainValidation", this is a finding.


vuln_id: V-228410
rule_id: SV-228410r879806_rule
severity: CAT II
title: Exchange must provide Mailbox databases in a highly available and redundant configuration.
cci: CCI-002385
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Exchange Server mailbox databases and any data contained in those mailboxes should be protected. This can be accomplished by configuring Mailbox servers and databases for high availability and site resilience.  

  A database availability group (DAG) is a component of the Mailbox server high availability and site resilience framework built into Microsoft Exchange Server 2016. A DAG is a group of Mailbox servers that hosts a set of databases and provides automatic database-level recovery from failures that affect individual servers or databases.

  A DAG is a boundary for mailbox database replication and database and server switchovers and failovers. 

  Any server in a DAG can host a copy of a mailbox database from any other server in the DAG. When a server is added to a DAG, it works with the other servers in the DAG to provide automatic recovery from failures that affect mailbox databases, such as a disk, server, or network failure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Update the EDSP to specify how Exchange Mailbox databases use redundancy.
  Access the Exchange Management Shell and add new Database Availability Groups based upon the EDSP using the following command:

  New-DatabaseAvailabilityGroup

  See the following documentation for options when creating a DAG:
  https://docs.microsoft.com/en-us/exchange/high-availability/manage-ha/create-dags?view=exchserver-2019.

check_text:
  Review the Email Domain Security Plan (EDSP).
  Determine if the Exchange Mailbox databases are using redundancy.
  Open the Exchange Management Shell.
  Enter the following command:
  Get-DatabaseAvailabilityGroup <DAGName> | Format-List
  If the DAG is not displayed, this is a finding.


vuln_id: V-228411
rule_id: SV-228411r879827_rule
severity: CAT II
title: Exchange must have the most current, approved service pack installed.
fix_text: Install the most current, approved service pack.
cci: CCI-002605
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Failure to install the most current Exchange service pack leaves a system vulnerable to exploitation. Current service packs correct known security and system vulnerabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Determine the most current, approved service pack.

  Open the Exchange Management Shell and enter the following command:

  Get-ExchangeServer | fl Name, AdminDisplayVersion

  If the value of "AdminDisplayVersion" does not return the most current, approved service pack, this is a finding.


vuln_id: V-228412
rule_id: SV-228412r879887_rule
severity: CAT II
fix_text: Configure web ports to be ports 80 and 443, as specified by PPSM standards.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The application must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

description:
  <VulnDiscussion>Configuring the application to implement organization-wide security implementation guides and security checklists ensures compliance with Federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements. 

  Configuration settings are the set of parameters that can be changed that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the application, including the parameters required to satisfy other security control requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Open a Windows PowerShell Module and enter the following commands: 

  Get-Website | Select Name

  Get-WebBinding -Name <'WebSiteName'> | Format-List

  If the Web binding values returned are not on standard port 80 for HTTP connections or port 443 for HTTPS connections, this is a finding. 

  Note: This is excluding the Exchange Back End website which uses 81/444.

  Repeat the process for each website.


vuln_id: V-228413
rule_id: SV-228413r879664_rule
severity: CAT II
title: The applications built-in Malware Agent must be disabled.
cci: CCI-001242
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Malicious code protection mechanisms include but are not limited to anti-virus and malware detection software. To minimize potential negative impact to the organization that can be caused by malicious code, it is imperative that malicious code is identified and eradicated. 

  Malicious code includes viruses, worms, trojan horses, and spyware. It is not enough to have the software installed; this software must periodically scan the system to search for malware on an organization-defined frequency. 

  Exchange's built-in Malware Agent is not designed to address all malicious code protection workloads. This workload is best handled by third-party anti-virus and intrusion prevention software.

  Sites must use an approved DoD scanner. Exchange Malware software has a limited scanning capability and does not scan files that are downloaded, opened, or executed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
[cell repeats an earlier one in this file: 134 characters]

check_text:
[cell repeats an earlier one in this file: 167 characters]


vuln_id: V-228415
rule_id: SV-228415r879519_rule
severity: CAT II
title: Exchange must use encryption for RPC client access.
cci: CCI-000068
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This setting controls whether client machines are forced to use secure channels to communicate with the server. If this feature is enabled, clients will only be able to communicate with the server over secure communication channels.

  Failure to require secure connections to the client access server increases the potential for unintended eavesdropping or data loss.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-RpcClientAccess -Server <ServerName> -EncryptionRequired $true

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-RpcClientAccess | Select Server, Name, EncryptionRequired

  If the value of "EncryptionRequired" is not set to "True", this is a finding.


vuln_id: V-228416
rule_id: SV-228416r879519_rule
severity: CAT II
title: Exchange must use encryption for Outlook Web App (OWA) access.
fix_text: Configure the OWA site to require SSL port 443.
cci: CCI-000068
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server.

  The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including Common Access Card (CAC)-enabled pre-authentication through an application firewall proxy.

  Failure to require secure connections on a website increases the potential for unintended eavesdropping or data loss.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

check_text:
  Open a Exchange Management Shell and enter the following command:

  Get-OwaVirtualDirectory | select internalurl, externalurl

  If the value returned is not https://, this is a finding.


vuln_id: V-228417
rule_id: SV-228417r879519_rule
severity: CAT II
title: Exchange must have forms-based authentication disabled.
cci: CCI-000068
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Identification and Authentication provide the foundation for access control. Access to email services applications in the DoD requires authentication using DoD Public Key Infrastructure (PKI) certificates. Authentication for Outlook Web App (OWA) is used to enable web access to user email mailboxes and should assume that certificate-based authentication has been configured. This setting controls whether forms-based logon should be used by the OWA website. 

  Because the DoD requires Common Access Card (CAC)-based authentication to applications, OWA access must be brokered through an application proxy or other pre-authenticator, which performs CAC authentication prior to arrival at the CA server. The authenticated request is then forwarded directly to OWA, where authentication is repeated without requiring the user to repeat authentication steps. For this scenario to work, the Application Proxy server must have forms-based authentication enabled, and Exchange must have forms-based Authentication disabled. 

  If forms-based Authentication is enabled on the Exchange CA server, it is evidence that the application proxy server is either not correctly configured, or it may be missing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-OwaVirtualDirectory -Identity <'IdentityName'> -FormsAuthentication $false

  Note: <IdentityName> must be in single quotes.

  Example for the Identity Name: <ServerName>\owa (Default website)

  Restart the ISS service.

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-OwaVirtualDirectory | Select ServerName, Name, Identity, FormsAuthentication

  If the value of "FormsAuthentication" is not set to "False", this is a finding.


vuln_id: V-228418
rule_id: SV-228418r879530_rule
severity: CAT II
title: Exchange must have authenticated access set to Integrated Windows Authentication only.
cci: CCI-000213
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. 

  Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. 

  This requirement is applicable to access control enforcement applications (e.g., authentication servers) and other applications that perform information and system access control functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Open the Exchange Management Shell and enter the following command:

  Set-OwaVirtualDirectory -Identity '<IdentityName>' -WindowsAuthentication $true

  Note: The <IdentityName> value must be in single quotes.

  Example for the Identity Name: <ServerName>\owa (Default website)

check_text:
  Open the Exchange Management Shell and enter the following command:

  Get-OwaVirtualDirectory | Select ServerName, Name, Identity,*Authentication
   
  If the value of "WindowsAuthentication" is not set to "True", this is a finding.


vuln_id: V-223015
rule_id: SV-223015r879887_rule
severity: CAT II
title: The Internet Explorer warning about certificate address mismatch must be enforced.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This parameter warns users if the certificate being presented by the website is invalid. Since server certificates are used to validate the identity of the web server it is critical to warn the user of a potential issue with the certificate being presented by the web server. This setting aids to prevent spoofing attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page 'Turn on certificate address mismatch warning' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page 'Turn on certificate address mismatch warning' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value "WarnOnBadCertRecving" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223016
rule_id: SV-223016r879612_rule
severity: CAT III
title: Check for publishers certificate revocation must be enforced.
cci: CCI-000185
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Check for publisher's certificate revocation options should be enforced to ensure all PKI signed objects are validated.

  Satisfies: SRG-APP-000605</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the system is on the SIPRNet, this requirement is NA.

  Open Internet Explorer.
  From the menu bar, select "Tools".
  From the "Tools" drop-down menu, select "Internet Options". From the "Internet Options" window, select the "Advanced" tab from the "Advanced" tab window, scroll down to the "Security" category, and select the "Check for publisher's certificate revocation" box.

  Note: Manual entry in the registry key:

  HKCU\Software\Microsoft\Windows\Current Version\WinTrust\Trust Providers\Software Publishing for the value "State", set to "REG_DWORD = 23C00", may first be required.

check_text:
  If the system is on the SIPRNet, this requirement is NA.

  Open Internet Explorer.
  From the menu bar, select "Tools".
  From the "Tools" drop-down menu, select "Internet Options". From the "Internet Options" window, select the "Advanced" tab, from the "Advanced" tab window, scroll down to the "Security" category, and verify the "Check for publisher's certificate revocation" box is selected.

  Procedure: Use the Windows Registry Editor to navigate to the following key:
   HKCU\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Criteria

  If the value "State" is "REG_DWORD = 23C00", this is not a finding.


vuln_id: V-223017
rule_id: SV-223017r879629_rule
severity: CAT II
title: The Download signed ActiveX controls property must be disallowed (Internet zone).
cci: CCI-001169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by untrusted publishers. Code signed by trusted publishers is silently downloaded. If you disable the policy setting, signed controls cannot be downloaded.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Download signed ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Download signed ActiveX controls' must be 'Enabled', and 'Disable' selected from the drop-down box.  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1001" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223018
rule_id: SV-223018r879629_rule
severity: CAT II
title: The Download unsigned ActiveX controls property must be disallowed (Internet zone).
cci: CCI-001169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Unsigned code is potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. If you enable this policy setting, users can run unsigned controls without user intervention. If you select "Prompt" in the drop-down box, users are queried to choose whether to allow the unsigned control to run. If you disable this policy setting, users cannot run unsigned controls. If you do not configure this policy setting, users cannot run unsigned controls.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Download unsigned ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Download unsigned ActiveX controls' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1004" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223019
rule_id: SV-223019r879630_rule
severity: CAT II
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Initialize and script ActiveX controls not marked as safe property must be disallowed (Internet zone).

description:
  <VulnDiscussion>ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Initialize and script ActiveX controls not marked as safe' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Initialize and script ActiveX controls not marked as safe' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1201" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223020
rule_id: SV-223020r879587_rule
severity: CAT II
title: The Java permissions must be disallowed (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223021
rule_id: SV-223021r879534_rule
severity: CAT II
title: Accessing data sources across domains must be disallowed (Internet zone).
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. Access to data sources across multiple domains must be controlled based upon the site being browsed. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Access data sources across domains' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Access data sources across domains' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1406" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223022
rule_id: SV-223022r879587_rule
severity: CAT II
title: Functionality to drag and drop or copy and paste files must be disallowed (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Content hosted on sites located in the Internet zone are likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the site being accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow drag and drop or copy and paste files' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow drag and drop or copy and paste files' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value for "1802" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223023
rule_id: SV-223023r879587_rule
severity: CAT II
title: Launching programs and files in IFRAME must be disallowed (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being accessed. If you enable this policy setting, applications can run and files can be downloaded from IFRAMEs on the pages in this zone without user intervention. If you disable this setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Launching applications and files in an IFRAME' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Launching applications and files in an IFRAME' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1804" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223024
rule_id: SV-223024r879534_rule
severity: CAT II
title: Navigating windows and frames across different domains must be disallowed (Internet zone).
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Frames that navigate across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a website hosting malicious content could use this feature in a manner similar to cross-site scripting (XSS). This policy setting allows you to manage the opening of sub-frames and access of applications across different domains.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Navigate windows and frames across different domains' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Navigate windows and frames across different domains' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\InternetSettings\Zones\3 Criteria: If the value "1607" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223025
rule_id: SV-223025r879642_rule
severity: CAT II
title: Userdata persistence must be disallowed (Internet zone).
cci: CCI-001199
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Userdata persistence must have a level of protection based upon the site being accessed. It is possible for sites hosting malicious content to exploit this feature as part of an attack against visitors browsing the site. This policy setting allows you to manage the preservation of information in the browser's history, in Favorites, in an XML store, or directly within a web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is not appropriately configured. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Userdata persistence' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Userdata persistence' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1606" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223026
rule_id: SV-223026r879587_rule
severity: CAT II
title: Clipboard operations via script must be disallowed (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible to exploit other vulnerabilities in order to send the harvested data to the attacker. Allow paste operations via script must have a level of protection based upon the site being accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow cut, copy or paste operations from the clipboard via script' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow cut, copy or paste operations from the clipboard via script' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1407" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223027
rule_id: SV-223027r879636_rule
severity: CAT II
title: Logon options must be configured to prompt (Internet zone).
cci: CCI-001184
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows credentials are passed to the websites. This policy setting allows management of settings for logon options. If you enable this policy setting, you can choose from varying logon options. “Anonymous logon” disables HTTP authentication and uses the guest account only for the Common Internet File System (CIFS) protocol. “Prompt for user name and password” queries users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon only in Intranet zone” queries users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon with current user name and password” attempts logon using Windows NT Challenge Response. If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for login. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password. If you disable this policy setting, logon is set to “Automatic logon only in Intranet zone”. If you do not configure this policy setting, logon is set to “Automatic logon only in Intranet zone”. The most secure option is to configure this setting to “Enabled”; “Anonymous logon”, but configuring this setting to “Enabled”; “Prompt for user name and password”, provides a reasonable balance between security and usability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Logon options' to 'Enabled', and select 'Prompt for user name and password' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Logon options' must be 'Enabled', and 'Prompt for user name and password' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1A00" is REG_DWORD = 65536 (decimal), this is not a finding.


vuln_id: V-223028
rule_id: SV-223028r879587_rule
severity: CAT II
title: Java permissions must be configured with High Safety (Intranet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Intranet Zone -> 'Java permissions' to 'Enabled', and select 'High Safety' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Intranet Zone -> 'Java permissions' must be 'Enabled', and 'High Safety' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Criteria: If the value "1C00" is REG_DWORD = 65536, (Decimal), this is not a finding.


vuln_id: V-223029
rule_id: SV-223029r879628_rule
severity: CAT II
title: Anti-Malware programs against ActiveX controls must be run for the Intranet zone.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages.      If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Intranet Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Intranet Zone 'Don't run antimalware programs against ActiveX controls' must be 'Enabled' and 'Disable' selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1  Criteria: If the value "270C" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223030
rule_id: SV-223030r879587_rule
severity: CAT II
title: Java permissions must be configured with High Safety (Trusted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Trusted Sites Zone -> 'Java permissions' to 'Enabled', and select 'High Safety' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Trusted Sites Zone -> 'Java permissions' must be 'Enabled', and 'High Safety' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Criteria: If the value "1C00" is REG_DWORD = 65536, (Decimal), this is not a finding.


vuln_id: V-223031
rule_id: SV-223031r879628_rule
severity: CAT II
title: Anti-Malware programs against ActiveX controls must be run for the Trusted Sites zone.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages.      If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Trusted Sites Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Trusted Sites Zone 'Don't run antimalware programs against ActiveX controls' must be 'Enabled' and 'Disable' selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2  Criteria: If the value "270C" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223032
rule_id: SV-223032r879534_rule
severity: CAT II
title: Dragging of content from different domains within a window must be disallowed (Internet zone).
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog box. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog box.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone 'Enable dragging of content from different domains within a window' to 'Enabled', and select 'Disabled' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone 'Enable dragging of content from different domains within a window' must be 'Enabled', and 'Disabled' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2708" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223033
rule_id: SV-223033r879534_rule
severity: CAT II
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Dragging of content from different domains across windows must be disallowed (Restricted Sites zone).

description:
  <VulnDiscussion>This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. If you enable this policy setting, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog box.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone 'Enable dragging of content from different domains across windows' to 'Enabled', and select 'Disabled' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone 'Enable dragging of content from different domains across windows' must be 'Enabled', and 'Disabled' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2709" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223034
rule_id: SV-223034r879573_rule
severity: CAT II
title: Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer).
cci: CCI-001695
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL   Criteria: If the value "explorer.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223035
rule_id: SV-223035r879573_rule
severity: CAT II
title: Internet Explorer Processes Restrict ActiveX Install must be enforced (iexplore).
cci: CCI-001695
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL   Criteria: If the value "iexplore.exe" is REG_SZ = 1, this is not a finding.


vuln_id: V-223036
rule_id: SV-223036r879534_rule
severity: CAT II
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Dragging of content from different domains within a window must be disallowed (Restricted Sites zone).

description:
  <VulnDiscussion>This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog box. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog box.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone 'Enable dragging of content from different domains within a window' to 'Enabled', and select 'Disabled' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone 'Enable dragging of content from different domains within a window' must be 'Enabled', and 'Disabled' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2708" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223037
rule_id: SV-223037r879628_rule
severity: CAT II
title: Anti-Malware programs against ActiveX controls must be run for the Internet zone.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages.      If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Internet Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Internet Zone 'Don't run antimalware programs against ActiveX controls' must be 'Enabled' and 'Disable' selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3  Criteria: If the value "270C" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223038
rule_id: SV-223038r879628_rule
severity: CAT II
title: Anti-Malware programs against ActiveX controls must be run for the Restricted Sites zone.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages.      If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Don't run antimalware programs against ActiveX controls' must be 'Enabled' and 'Disable' selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4  Criteria: If the value "270C" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223039
rule_id: SV-223039r879664_rule
severity: CAT II
title: Prevent bypassing SmartScreen Filter warnings must be enabled.
cci: CCI-001242
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host malicious content. SmartScreen Filter also prevents the execution of files that are known to be malicious. If you enable this policy setting, SmartScreen Filter warnings block the user. If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the system is on the SIPRNet, this requirement is NA.

  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent bypassing SmartScreen Filter warnings” to ”Enabled”.

check_text:
  If the system is on the SIPRNet, this requirement is NA.

  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent bypassing SmartScreen Filter warnings” must be ”Enabled”. 

  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter. 

  Criteria: If the value "PreventOverride" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223040
rule_id: SV-223040r879629_rule
severity: CAT II
cci: CCI-001169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the internet must be enabled.

description:
  <VulnDiscussion>This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly download from the internet. If you enable this policy setting, SmartScreen Filter warnings block the user. If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  If the system is on the SIPRNet, this requirement is NA.

  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the internet” to ”Enabled”.

check_text:
  If the system is on the SIPRNet, this requirement is NA.

  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the internet” must be ”Enabled”. 

  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter.

  Criteria: If the value "PreventOverrideAppRepUnknown" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223041
rule_id: SV-223041r879630_rule
severity: CAT II
title: Prevent per-user installation of ActiveX controls must be enabled.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to prevent the installation of ActiveX controls on a per-user basis. If you enable this policy setting, ActiveX controls cannot be installed on a per-user basis. If you disable or do not configure this policy setting, ActiveX controls can be installed on a per-user basis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent per-user installation of ActiveX controls” to ”Enabled”.

check_text:
  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent per-user installation of ActiveX controls” must be ”Enabled”. 

  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX. 

  Criteria: If the value "BlockNonAdminActiveXInstall" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223042
rule_id: SV-223042r942482_rule
severity: CAT II
title: Prevent ignoring certificate errors option must be enabled.
cci: CCI-001954
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing (such as “expired”, “revoked”, or “name mismatch” errors) in Internet Explorer. If you enable this policy setting, the user cannot continue browsing. If you disable or do not configure this policy setting, the user can choose to ignore certificate errors and continue browsing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> ”Prevent ignoring certificate errors” to ”Enabled”.

check_text:
  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> ”Prevent ignoring certificate errors” must be ”Enabled”. 

  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings. 

  Criteria: If the value "PreventIgnoreCertErrors" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223043
rule_id: SV-223043r879664_rule
severity: CAT II
title: Turn on SmartScreen Filter scan option for the Internet Zone must be enabled.
cci: CCI-001242
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone >> ”Turn on SmartScreen Filter scan” to ”Enabled”, and select ”Enable” from the drop-down box.

check_text:
  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone >> ”Turn on SmartScreen Filter scan” must be ”Enabled” and ”Enable” selected from the drop-down box. 

  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3. 

  Criteria: If the value "2301" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223044
rule_id: SV-223044r879664_rule
severity: CAT II
title: Turn on SmartScreen Filter scan option for the Restricted Sites Zone must be enabled.
cci: CCI-001242
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone >> ”Turn on SmartScreen Filter scan” to ”Enabled”, and select ”Enable” from the drop-down box.

check_text:
  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone >> ”Turn on SmartScreen Filter scan” must be ”Enabled” and ”Enable” selected from the drop-down box. 

  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4. 

  Criteria: If the value "2301" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223045
rule_id: SV-223045r879630_rule
severity: CAT II
title: The Initialize and script ActiveX controls not marked as safe must be disallowed (Intranet Zone).
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Intranet Zone >> ”Initialize and script ActiveX controls not marked as safe” to ”Enabled”, and select ”Disable” from the drop-down box.

check_text:
  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Intranet Zone >> ”Initialize and script ActiveX controls not marked as safe” must be ”Enabled” and ”Disable” selected from the drop-down box. 

  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1. 

  Criteria: If the value "1201" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223046
rule_id: SV-223046r879630_rule
severity: CAT II
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Initialize and script ActiveX controls not marked as safe must be disallowed (Trusted Sites Zone).

description:
  <VulnDiscussion>ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Trusted Sites Zone >> ”Initialize and script ActiveX controls not marked as safe” to ”Enabled”, and select ”Disable” from the drop-down box.

check_text:
  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Trusted Sites Zone >> ”Initialize and script ActiveX controls not marked as safe” must be ”Enabled” and ”Disable” selected from the drop-down box. 

  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2. 

  Criteria: If the value "1201" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223048
rule_id: SV-223048r879587_rule
severity: CAT II
title: Run once selection for running outdated ActiveX controls must be disabled.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This feature keeps ActiveX controls up to date and helps make them safer to use in Internet Explorer. Many ActiveX controls are not automatically updated as new versions are released. It is very important to keep ActiveX controls up to date because malicious or compromised webpages can target security flaws in out-of-date ActiveX controls.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> Add-on Management, set "Remove the Run this time button for outdated ActiveX controls in IE" to "Enabled".

check_text:
  In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> Add-on Management, verify "Remove the Run this time button for outdated ActiveX controls in IE" is set to “Enabled”. 

  Use the Windows Registry Editor to navigate to the following key: 

  HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext 

  If the value "RunThisTimeEnabled" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223049
rule_id: SV-223049r879587_rule
severity: CAT II
title: Enabling outdated ActiveX controls for Internet Explorer must be blocked.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This feature keeps ActiveX controls up to date and helps make them safer to use in Internet Explorer. Many ActiveX controls are not automatically updated as new versions are released. It is very important to keep ActiveX controls up to date because malicious or compromised webpages can target security flaws in out-of-date ActiveX controls.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> Add-on Management, set "Turn off blocking of outdated ActiveX controls for Internet Explorer" to "Disabled".

check_text:
  In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> Add-on Management, verify "Turn off blocking of outdated ActiveX controls for Internet Explorer" is set to “Disabled”. 

  Use the Windows Registry Editor to navigate to the following key: 

  HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext 

  If the value "VersionCheckEnabled" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223050
rule_id: SV-223050r879587_rule
severity: CAT II
title: Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Internet Zone.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and Restricted Sites security zones. If you enable this policy setting, users will not be able to run the TDC ActiveX control from all sites in the specified zone.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Pane >> Security Page >> Internet Zone, set the "Allow only approved domains to use the TDC ActiveX control" to “Enabled”. 

  In the Options window, select "Enable" from the “Only allow approved domains to use the TDC ActiveX control" drop-down box.

check_text:
  In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone, verify "Allow only approved domains to use the TDC ActiveX control" is “Enabled”. 

  In the Options window, verify the “Only allow approved domains to use the TDC ActiveX control" drop-down box is set to “Enable”. 

  Procedure: Use the Windows Registry Editor to navigate to the following key: 

  HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 

  Criteria: 

  If the value "120c" is REG_DWORD = “3”, this is not a finding.


vuln_id: V-223051
rule_id: SV-223051r879629_rule
severity: CAT II
title: The Download signed ActiveX controls property must be disallowed (Restricted Sites zone).
cci: CCI-001169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especially when coming from an untrusted zone.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Download signed ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Download signed ActiveX controls' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1001" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223052
rule_id: SV-223052r879587_rule
severity: CAT II
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Restricted Sites Zone.

description:
  <VulnDiscussion>This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and Restricted Sites security zones. If you enable this policy setting, users won’t be able to run the TDC ActiveX control from all sites in the specified zone.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone, set the "Allow only approved domains to use the TDC ActiveX control" to “Enabled”.

  In the Options windows, select "Enable" from the “Only allow approved domains to use the TDC ActiveX control" drop-down box.

check_text:
  In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone, verify "Allow only approved domains to use the TDC ActiveX control" is “Enabled”. 

  In the Options window, verify the “Only allow approved domains to use the TDC ActiveX control" drop-down box is set to “Enable”. 

  Procedure: Use the Windows Registry Editor to navigate to the following key: 

  HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 

  Criteria: 

  If the value "120c" is REG_DWORD = “3”, this is not a finding.


vuln_id: V-223053
rule_id: SV-223053r879629_rule
severity: CAT II
title: VBScript must not be allowed to run in Internet Explorer (Internet zone).
cci: CCI-001169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows the management of whether VBScript can be run on pages from the specified zone in Internet Explorer. By selecting "Enable" in the drop-down box, VBScript can run without user intervention. By selecting "Prompt" in the drop-down box, users are asked to choose whether to allow VBScript to run. By selecting "Disable" in the drop-down box, VBScript is prevented from running. If this policy setting is not configured or disabled, VBScript will run without user intervention.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone >> "Allow VBScript to run in Internet Explorer" to "Enabled" and select "Disable" from the drop-down box.

check_text:
  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone >> "Allow VBScript to run in Internet Explorer" must be "Enabled", and "Disable" must be selected from the drop-down box. 

  Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

  If the value for "140C" is not REG_DWORD = 3, this is a finding.


vuln_id: V-223054
rule_id: SV-223054r879629_rule
severity: CAT II
title: The Download unsigned ActiveX controls property must be disallowed (Restricted Sites zone).
cci: CCI-001169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Unsigned code is potentially harmful, especially when coming from an untrusted zone. ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. They must also be digitally signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Download unsigned ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Download unsigned ActiveX controls' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1004" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223055
rule_id: SV-223055r879629_rule
severity: CAT II
title: VBScript must not be allowed to run in Internet Explorer (Restricted Sites zone).
cci: CCI-001169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows the management of whether VBScript can be run on pages from the specified zone in Internet Explorer. By selecting "Enable" in the drop-down box, VBScript can run without user intervention. By selecting "Prompt" in the drop-down box, users are asked to choose whether to allow VBScript to run. By selecting "Disable" in the drop-down box, VBScript is prevented from running. If this policy setting is not configured or disabled, VBScript will run without user intervention.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone >> "Allow VBScript to run in Internet Explorer" to "Enabled" and select "Disable" from the drop-down box.

check_text:
  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone >> "Allow VBScript to run in Internet Explorer" must be "Enabled", and "Disable" must be selected from the drop-down box.

  Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4

  If the value for "140C" is not REG_DWORD = 3, this is a finding.


vuln_id: V-223056
rule_id: SV-223056r879655_rule
severity: CAT III
title: Internet Explorer Development Tools Must Be Disabled.
cci: CCI-001312
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>While the risk associated with browser development tools is more related to the proper design of a web application, a risk vector remains within the browser. The developer tools allow end users and application developers to view and edit all types of web application related data via the browser. Page elements, source code, javascript, API calls, application data, etc. may all be viewed and potentially manipulated. Manipulation could be useful for troubleshooting legitimate issues, and this may be performed in a development environment. Manipulation could also be malicious and must be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Toolbars >> “Turn off Developer Tools” to “Enabled”.

check_text:
  The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Toolbars >> “Turn off Developer Tools” must be “Enabled”. 
  Procedure: Use the Windows Registry Editor to navigate to the following key: HKEY_LOCAL_Machine\SOFTWARE\Policies\Microsoft\Internet Explorer\IEDevTools
  Criteria: If the value "Disabled" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223057
rule_id: SV-223057r879630_rule
severity: CAT II
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Sites zone).

description:
  <VulnDiscussion>ActiveX controls not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Initialize and script ActiveX controls not marked as safe' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Initialize and script ActiveX controls not marked as safe' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1201" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223058
rule_id: SV-223058r879887_rule
severity: CAT II
title: ActiveX controls and plug-ins must be disallowed (Restricted Sites zone).
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. ActiveX controls not marked as safe should not be executed. If you enable this policy setting, controls and plug-ins can run without user intervention. If you disable this policy setting, controls and plug-ins are prevented from running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run ActiveX controls and plugins' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run ActiveX controls and plugins' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1200" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223059
rule_id: SV-223059r879630_rule
severity: CAT II
title: ActiveX controls marked safe for scripting must be disallowed (Restricted Sites zone).
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows management of whether ActiveX controls marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur automatically without user intervention. ActiveX controls not marked as safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Script ActiveX controls marked safe for scripting' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Script ActiveX controls marked safe for scripting' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1405" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223060
rule_id: SV-223060r879587_rule
severity: CAT II
title: File downloads must be disallowed (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Sites located in the Restricted Sites Zone are more likely to contain malicious payloads and therefore downloads from this zone should be blocked. Files should not be able to be downloaded from sites that are considered restricted. This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow file downloads' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow file downloads' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1803" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223061
rule_id: SV-223061r879587_rule
severity: CAT II
title: Java permissions must be disallowed (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223062
rule_id: SV-223062r879534_rule
severity: CAT II
title: Accessing data sources across domains must be disallowed (Restricted Sites zone).
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Access data sources across domains' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Access data sources across domains' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1406" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223063
rule_id: SV-223063r879887_rule
severity: CAT II
title: The Allow META REFRESH property must be disallowed (Restricted Sites zone).
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>It is possible that users will unknowingly be redirected to a site hosting malicious content. 'Allow META REFRESH' must have a level of protection based upon the site being browsed. This policy setting allows you to manage whether a user's browser can be redirected to another web page if the author of the web page uses the Meta Refresh setting to redirect browsers to another web page.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow META REFRESH' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow META REFRESH' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1608" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223064
rule_id: SV-223064r879587_rule
severity: CAT II
title: Functionality to drag and drop or copy and paste files must be disallowed (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Content hosted on sites located in the Restricted Sites zone are more likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the site being accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow drag and drop or copy and paste files' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow drag and drop or copy and paste files' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1802" is REG_DWORD=3, this is not a finding.


vuln_id: V-223065
rule_id: SV-223065r879587_rule
severity: CAT II
title: Launching programs and files in IFRAME must be disallowed (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being accessed. If you enable this policy setting, applications can run and files can be downloaded from IFRAMEs on the pages in this zone without user intervention. If you disable this setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Launching applications and files in an IFRAME' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Launching applications and files in an IFRAME' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1804" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223066
rule_id: SV-223066r879534_rule
severity: CAT II
title: Navigating windows and frames across different domains must be disallowed (Restricted Sites zone).
cci: CCI-001414
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Frames navigating across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a website hosting malicious content could use this feature in a manner similar to cross-site scripting (XSS). This policy setting allows you to manage the opening of sub-frames and access of applications across different domains.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Navigate windows and frames across different domains' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Navigate windows and frames across different domains' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1607" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223067
rule_id: SV-223067r879642_rule
severity: CAT II
title: Userdata persistence must be disallowed (Restricted Sites zone).
cci: CCI-001199
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Userdata persistence must have a level of protection based upon the site being accessed. This policy setting allows you to manage the preservation of information in the browser's history, in Favorites, in an XML store, or directly within a web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is not appropriately configured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Userdata persistence' to 'Enabled', and select 'Disable' from the drop-down box

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Userdata persistence' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1606" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223068
rule_id: SV-223068r879587_rule
severity: CAT II
title: Active scripting must be disallowed (Restricted Sites Zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Active scripts hosted on sites located in this zone are more likely to contain malicious code. Active scripting must have a level of protection based upon the site being accessed. This policy setting allows you to manage whether script code on pages in the zone are run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow active scripting' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow active scripting' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1400" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223069
rule_id: SV-223069r879587_rule
severity: CAT II
title: Clipboard operations via script must be disallowed (Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible to exploit other vulnerabilities in order to send the harvested data to the attacker. Allow paste operations via script must have a level of protection based upon the site being accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow cut, copy or paste operations from the clipboard via script' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow cut, copy or paste operations from the clipboard via script' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1407" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223070
rule_id: SV-223070r879636_rule
severity: CAT II
title: Logon options must be configured and enforced (Restricted Sites zone).
cci: CCI-001184
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows credentials are passed to the websites. This policy setting allows management of settings for logon options. If you enable this policy setting, you can choose from varying logon options. “Anonymous logon” disables HTTP authentication and uses the guest account only for the Common Internet File System (CIFS) protocol. “Prompt for user name and password” queries users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon only in Intranet zone” queries users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon with current user name and password” attempts logon using Windows NT Challenge Response. If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for login. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password. If you disable this policy setting, logon is set to “Automatic logon only in Intranet zone”. If you do not configure this policy setting, logon is set to “Automatic logon only in Intranet zone”. The most secure option is to configure this setting to “Enabled”; “Anonymous logon”. This will prevent users from submitting credentials to servers in this security zone.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Logon options' to 'Enabled', and select 'Anonymous logon' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Logon options' must be 'Enabled', and 'Anonymous logon' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "1A00" is REG_DWORD = 196608 (decimal), this is not a finding.


vuln_id: V-223071
rule_id: SV-223071r879559_rule
severity: CAT II
title: Configuring History setting must be set to 40 days.
cci: CCI-000169
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options, "General" tab, and then click Settings under Browsing History. If you enable this policy setting, a user cannot set the number of days that Internet Explorer keeps track of the pages viewed in the History List. The number of days that Internet Explorer keeps track of the pages viewed in the History List must be specified. Users will not be able to delete browsing history. If you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History List. Users can delete browsing history.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Disable Configuring History' to 'Enabled', and enter '40' in 'Days to keep pages in History'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Disable Configuring History' must be 'Enabled', and '40' entered in 'Days to keep pages in History'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: If the value "History" is REG_DWORD = 1, this is not a finding. AND  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Url History Criteria: If the value "DaysToKeep" is REG_DWORD = 40 (decimal), this is not a finding.


vuln_id: V-223072
rule_id: SV-223072r879587_rule
severity: CAT II
title: Internet Explorer must be set to disallow users to add/delete sites.
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This setting prevents users from adding sites to various security zones. Users should not be able to add sites to different zones, as this could allow them to bypass security controls of the system. If you do not configure this policy setting, users will be able to add or remove sites from the Trusted Sites and Restricted Sites zones at will and change settings in the Local Intranet zone. This configuration could allow sites that host malicious mobile code to be added to these zones, and users could execute the code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Do not allow users to add/delete sites' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Do not allow users to add/delete sites' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value "Security_zones_map_edit" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223073
rule_id: SV-223073r879887_rule
severity: CAT II
title: Internet Explorer must be configured to disallow users to change policies.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. This setting prevents users from changing the Internet Explorer policies on the machine. Policy changes should be made by administrators only, so this setting should be enabled. If you enable this policy setting, you disable the "Custom level" button and "Security" level for this zone slider on the Security tab in the Internet Options dialog box. If this policy setting is disabled or not configured, users will be able to change the settings for security zones. It prevents users from changing security zone policy settings that are established by the administrator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Do not allow users to change policies' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Do not allow users to change policies' must be 'Enabled'.  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value "Security_options_edit" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223074
rule_id: SV-223074r879887_rule
severity: CAT II
title: Internet Explorer must be configured to use machine settings.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. This setting enforces consistent security zone settings to all users of the computer. Security zones control browser behavior at various websites and it is desirable to maintain a consistent policy for all users of a machine. This policy setting affects how security zone changes apply to different users. If you enable this policy setting, changes that one user makes to a security zone will apply to all users of that computer. If this policy setting is disabled or not configured, users of the same computer are allowed to establish their own security zone settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Use only machine settings' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Use only machine settings' must be 'Enabled'.  Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value "Security_HKLM_only" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223075
rule_id: SV-223075r879887_rule
severity: CAT II
title: Security checking features must be enforced.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. If you enable this policy setting, the security settings check will not be performed. If you disable or do not configure this policy setting, the security settings check will be performed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off the Security Settings Check feature' to 'Disabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off the Security Settings Check feature' must be 'Disabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Security Criteria: If the value "DisableSecuritySettingsCheck" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223076
rule_id: SV-223076r879630_rule
severity: CAT II
title: Software must be disallowed to run or install with invalid signatures.
cci: CCI-001170
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Microsoft ActiveX controls and file downloads often have digital signatures attached that certify the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure unmodified software is downloaded and the user can positively identify the signer to determine whether you trust them enough to run their software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Allow software to run or install even if the signature is invalid' to 'Disabled'.

check_text:
  Note: Some legitimate software and controls may have an invalid signature. You should carefully test such software in isolation before it is allowed to be used on an organization's network.

  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Allow software to run or install even if the signature is invalid' must be 'Disabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Download Criteria: If the value "RunInvalidSignatures" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223077
rule_id: SV-223077r879643_rule
severity: CAT II
cci: CCI-001084
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  The 64-bit tab processes, when running in Enhanced Protected Mode on 64-bit versions of Windows, must be turned on.

description:
  <VulnDiscussion>This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.Important: Some ActiveX controls and toolbars may not be available when 64-bit processes are used. If you enable this policy setting, Internet Explorer 11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. If you disable this policy setting, Internet Explorer 11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. If you don't configure this policy setting, users can turn this feature on or off using Internet Explorer settings. This feature is turned off by default.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Advanced Page 'Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows' to 'Enabled'.

check_text:
  Note: If McAfee ENS Web Control is being used, this is Not Applicable.

  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Advanced Page 'Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value "Isolation64Bit" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223078
rule_id: SV-223078r879612_rule
severity: CAT III
title: Checking for server certificate revocation must be enforced.
cci: CCI-000185
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure. If you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked. If you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. If you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.

  Satisfies: SRG-APP-000605</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Check for server certificate revocation' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Check for server certificate revocation' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value "CertificateRevocation" is REG_DWORD = 1, this is not a finding.


vuln_id: V-223079
rule_id: SV-223079r942483_rule
severity: CAT II
title: Checking for signatures on downloaded programs must be enforced.
cci: CCI-001749
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it has not been modified or tampered with) on user computers before downloading executable programs. If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to the user computers. If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to the user computers. If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to the user computers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Check for signatures on downloaded programs' to 'Enabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Check for signatures on downloaded programs' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Download Criteria: If the value "CheckExeSignatures" is REG_SZ = yes, this is not a finding.


vuln_id: V-223080
rule_id: SV-223080r879887_rule
severity: CAT II
title: All network paths (UNCs) for Intranet sites must be disallowed.
cci: CCI-000366
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Some UNC paths could refer to servers not managed by the organization, which means they could host malicious content; and therefore, it is safest to not include all UNC paths in the Intranet Sites zone. This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone. If you enable this policy setting, all network paths are mapped into the Intranet Zone. If you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there). If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> 'Intranet Sites: Include all network paths (UNCs)' to 'Disabled'.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> 'Intranet Sites: Include all network paths (UNCs)' must be 'Disabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Criteria: If the value "UNCAsIntranet" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223081
rule_id: SV-223081r879587_rule
severity: CAT II
title: Script-initiated windows without size or position constraints must be disallowed (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow script-initiated windows without size or position constraints' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow script-initiated windows without size or position constraints' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2102" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223082
rule_id: SV-223082r879587_rule
severity: CAT II
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
title:
  Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone).

description:
  <VulnDiscussion>This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow script-initiated windows without size or position constraints' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow script-initiated windows without size or position constraints' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: If the value "2102" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223083
rule_id: SV-223083r879587_rule
severity: CAT II
title: Scriptlets must be disallowed (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow Scriptlets' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow Scriptlets' must be 'Enabled', and 'Disable' from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "1209" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223084
rule_id: SV-223084r879587_rule
severity: CAT II
title: Automatic prompting for file downloads must be disallowed (Internet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, and those downloaded files may include malicious code. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the information bar instead of the file download dialog. Users can then click the information bar to allow the file download prompt.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Automatic prompting for file downloads' to 'Enabled', and select 'Disable' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Automatic prompting for file downloads' must be 'Enabled', and 'Disable' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value "2200" is REG_DWORD = 3, this is not a finding.


vuln_id: V-223085
rule_id: SV-223085r879587_rule
severity: CAT II
title: Java permissions must be disallowed (Local Machine zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.  </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Local Machine Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Local Machine Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223086
rule_id: SV-223086r879628_rule
severity: CAT II
title: Anti-Malware programs against ActiveX controls must be run for the Local Machine zone.
cci: CCI-001662
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages.      If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Local Machine Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page ->Local Machine Zone 'Don't run antimalware programs against ActiveX controls' must be 'Enabled' and 'Disable' selected in the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0  Criteria: If the value "270C" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223087
rule_id: SV-223087r879587_rule
severity: CAT II
title: Java permissions must be disallowed (Locked Down Local Machine zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Local Machine Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Local Machine Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223088
rule_id: SV-223088r879587_rule
severity: CAT II
title: Java permissions must be disallowed (Locked Down Intranet zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Intranet Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Intranet Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 Criteria: If the value" 1C00" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223089
rule_id: SV-223089r879587_rule
severity: CAT II
title: Java permissions must be disallowed (Locked Down Trusted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Trusted Sites Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Trusted Sites Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.


vuln_id: V-223090
rule_id: SV-223090r879587_rule
severity: CAT II
title: Java permissions must be disallowed (Locked Down Restricted Sites zone).
cci: CCI-000381
created_at: 2026-01-14 17:55:45
updated_at: 2026-01-14 17:55:45
description:
  <VulnDiscussion>Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

fix_text:
  Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Restricted Sites Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.

check_text:
  The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Restricted Sites Zone -> 'Java permissions' must be 'Enabled', and 'Disable Java' selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 Criteria: If the value "1C00" is REG_DWORD = 0, this is not a finding.


