Exchange must use encryption for RPC client access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-228415	EX16-MB-002900	SV-228415r879519_rule		Medium

Description

This setting controls whether client machines are forced to use secure channels to communicate with the server. If this feature is enabled, clients will only be able to communicate with the server over secure communication channels. Failure to require secure connections to the client access server increases the potential for unintended eavesdropping or data loss.

STIG	Date
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide	2023-12-18

Details

Check Text (C-30648r497041_chk)

Open the Exchange Management Shell and enter the following command:

Get-RpcClientAccess | Select Server, Name, EncryptionRequired

If the value of "EncryptionRequired" is not set to "True", this is a finding.

Fix Text (F-30633r497042_fix)

Open the Exchange Management Shell and enter the following command:

Set-RpcClientAccess -Server <ServerName> -EncryptionRequired $true