UCF STIG Viewer Logo

Exchange OWA must use https.


Overview

Finding ID Version Rule ID IA Controls Severity
V-234794 EX13-CA-000150 SV-234794r617323_rule High
Description
Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.
STIG Date
Microsoft Exchange 2013 Client Access Server Security Technical Implementation Guide 2021-12-16

Details

Check Text ( C-37980r617321_chk )
If the exchange server does not provide OWA services, this check is Not Applicable.
If the exchange server does not provide external OWA services, https does not need to be assigned to external URL, it may be blank.
Open the Exchange Management Shell and enter the following command:

Get-OWAVirtualDirectory | Select Name, Identity, ExternalUrl, InternalUrl

If the value returned is not both ExternalUrl and InternalUrl and these are not set to https://, this is a finding.

Fix Text (F-37943r617322_fix)
Open the Exchange Management Shell and enter the following command:

Set-OWAVirtualDirectory -Identity '\owa (Default Web Site)' -ExternalUrl 'https://URL' -InternalUrl 'https://URL'

Note: The \owa (default web site) value must be in quotes.