Details

To reduce the vectors through which a server can be attacked, unneeded application components should be disabled or removed. By default, a virtual directory is installed for Active Sync, and the Exchange application default has Active Sync disabled.

If an attacker were to intrude into an Exchange CA server and reactivate Active Sync, this attack vector could once again be open, provided the virtual directory is present.

Once removed, the Active Sync functionality cannot be used without restoring the virtual directory, not a trivial process.

Solution

Open an Exchange Command Shell and enter the following command:

Remove-ActiveSyncVirtualDirectory Microsoft-Server-ActiveSync -Confirm $true

Note: The physical directory must also be deleted.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Exchange_2013_Y21M01_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.

References

• 800-53|CM-7a.
• CAT|III
• CCI|CCI-000381
• Rule-ID|SV-84381r1_rule
• STIG-ID|EX13-CA-000110
• Vuln-ID|V-69759

Source

• Tenable.com/audits