Details

Sending unencrypted email over the Internet increases the risk that messages can be intercepted or altered. TLS is designed to protect confidentiality and data integrity by encrypting email messages between servers and thereby reducing the risk of eavesdropping, interception, and alteration. This setting forces Exchange to offer TLS before using basic authentication.

Solution

Open the Exchange Management Shell and enter the following command:

Set-ReceiveConnector -Identity <'IdentityName'> -AuthMechanism ‘Tls, BasicAuth, BasicAuthRequireTLS’

Note: The value must be in single quotes.

Example only for the Identity: Frontend

Repeat the procedure for each receive connector.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Exchange_2016_Y21M07_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Windows.

References

• 800-53|SC-23
• CAT|II
• CCI|CCI-001184
• Rule-ID|SV-221219r612603_rule
• STIG-ID|EX16-ED-000180
• STIG-Legacy|SV-95229
• STIG-Legacy|V-80519
• Vuln-ID|V-221219

Source

• Tenable.com/audits