Skip to content
ATO Pathways
Log In
Overview
Search
Catalogs
SCAP
OSCAL
Catalogs
Profiles
Documents
References
Knowledge Base
Platform Documentation
Compliance Dictionary
Platform Changelog
About
Catalogs
XCCDF
Exchange 2010 Client Access Server STIG
Exch-1-103
The Public Folder virtual directory must be removed if not in use by the site.
The Public Folder virtual directory must be removed if not in use by the site.
An XCCDF Rule
Details
Profiles
Prose
The Public Folder virtual directory must be removed if not in use by the site.
Low Severity
<VulnDiscussion>To reduce the vectors through which a server can be attacked, unneeded application components should be disabled or removed. By default, a virtual directory is installed for Public Folders. If an attacker were to intrude into an Exchange CA server and be able to access the public folder web site, it would provide an additional attack vector, provided the virtual directory was present. Once removed, the Public functionality cannot be used without restoring the virtual directory. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>