Samsung Android Workspace must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-93929	KNOX-09-001365	SV-104015r1_rule		Medium

Description
Password Recovery is a feature of Microsoft EAS. Exceeding the Password Attempts limit triggers the Lock screen to open a Password Recovery Mode. This feature must be disabled for a Samsung Android device to be in the NIAP-certified Common Criteria (CC) mode of operation. If Microsoft EAS Password Recovery is enabled, the Samsung device will be out of compliance with the CC Mode configuration. This requirement is configured on the Exchange server. It is the responsibility of the DoD mobile service provider to ensure that the Exchange server has been configured in compliance with the requirement. SFR ID: FMT_SMF_EXT.1.1 #47

Description

Password Recovery is a feature of Microsoft EAS. Exceeding the Password Attempts limit triggers the Lock screen to open a Password Recovery Mode. This feature must be disabled for a Samsung Android device to be in the NIAP-certified Common Criteria (CC) mode of operation. If Microsoft EAS Password Recovery is enabled, the Samsung device will be out of compliance with the CC Mode configuration. This requirement is configured on the Exchange server. It is the responsibility of the DoD mobile service provider to ensure that the Exchange server has been configured in compliance with the requirement. SFR ID: FMT_SMF_EXT.1.1 #47

STIG	Date
Samsung Android OS 9 with Knox 3.x COPE Use Case KPE(Legacy) Deployment Security Technical Implementation Guide	2020-05-15

Details

Check Text ( C-93247r1_chk )
Verify that the Microsoft EAS Password Recovery has been disabled on the Exchange server. If on the Microsoft EAS server "password recovery" is not disabled, this is a finding.

Fix Text (F-100177r1_fix)
Configure Samsung Android Workspace to not enable Microsoft EAS Password Recovery. The DoD mobile service provider should verify that the Exchange server is configured to disable Microsoft EAS Password Recovery.