UCF STIG Viewer Logo

The Microsoft Exchange forms-based authentication service must be disabled.


Finding ID Version Rule ID IA Controls Severity
EXCH-CA-106 EXCH-CA-106 EXCH-CA-106_rule Medium
Identification and Authentication provide the foundation for access control. Access to email services applications in the DoD require authentication using DoD Public Key Infrastructure (PKI) certificates. There are two sections to using form-based authentication the service must be running and the option to use forms-based authentication must be enabled. Forms-based login enables a user to enter a username and password to logon to the system. By disabling the forms-based authentication service malicious users will not have the ability to enter users name and password to access a system.
Microsoft Exchange 2010 Client Access Server Role 2012-05-31


Check Text ( C-_chk )
Open the Windows Power Shell and enter the following command.

Get-ItemProperty "hklm:\system\currentcontrolset\services\MSExchangeFDS" | Select Start

If the value of "Start" is not set to "4", this is a finding.
Fix Text (F-_fix)
Open the Windows Power Shell and enter the following command.


Double click the "Microsoft Exchange Forms-Based Authentication" service and select the General tab.

Set the "Startup Type" to "Disabled", click ok.