Exchange auto-forwarding email to remote domains must be disabled or restricted.

An XCCDF Rule

Description

<VulnDiscussion>Attackers can use automated messages to determine whether a user account is active, in the office, traveling, and so on. An attacker might use this information to conduct future attacks. Verify Automatic Forwards to remote domains are disabled, except for enterprise mail that must be restricted to forward only to .mil and .gov. domains. Before enabling this setting, configure a remote domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-259651r960801_rule
Severity: Medium
References: CCI-001368
Updated: 20 days ago

For Non-Enterprise Mail:

Open the Exchange Management Shell and enter the following command:

Set-RemoteDomain -Identity <'IdentityName'> -AutoForwardEnabled $false 
Note: The <IdentityName> value must be in quotes.

For Enterprise Mail:

New-RemoteDomain -Name <NewRemoteDomainName> -DomainName <SMTP Address>

Note: <NewRemoteDomainName> must either be a .mil or .gov domain.

Set-RemoteDomain -Identity <'RemoteDomainIdentity'> -AutoForwardEnabled $true

Note: The <RemoteDomainIdentity> value must be in quotes.

Exchange auto-forwarding email to remote domains must be disabled or restricted.

Description

Remediation - Manual Procedure