The Exchange Internet Message Access Protocol 4 (IMAP4) service must be disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259667	EX19-MB-000065	SV-259667r942315_rule		Medium

Description
IMAP4 is not approved for use within the DOD. It uses a clear-text-based user name and password and does not support the DOD standard for PKI for email access. User name and password could easily be captured from the network, allowing a malicious user to access other system features. Uninstalling or disabling the service will prevent the use of the IMAP4 protocol.

STIG	Date
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide	2024-01-10

Details

Check Text ( C-63406r942313_chk )
Note: This requirement applies to IMAP4. IMAP Secure is not restricted and does not apply to this requirement. Open the Windows PowerShell and enter the following command: Get-Service -Name MSExchangeIMAPBE,MSExchangeImap4 |Select-Object -Property Name,StartType If ANY of the IMAP services StartType is NOT set to "Disabled", this is a finding.

Fix Text (F-63314r942314_fix)
Open the Windows PowerShell in an Elevated Prompt and enter the following commands: Get-Service -Name MSExchangeIMAPBE,MSExchangeImap4 |ForEach-Object {Set-Service -Name $_.Name -StartupType Disabled}