EX16-MB-000190 - The Exchange Post Office Protocol 3 (POP3) service must be disabled.

Information

POP3 is not approved for use within the DoD. It uses a clear-text-based user name and password and does not support the DoD standard for PKI for email access. User name and password could easily be captured from the network, allowing a malicious user to access other system features. Uninstalling or disabling the service will prevent the use of POP3.

Solution

Open the Windows Power Shell and enter the following command:

services.msc

Navigate to and double-click on 'Microsoft Exchange POP3 Backend'.

Click on the 'General' tab.

In the 'Startup Type' dropdown, select 'Disabled'.

Click the 'OK' button.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Exchange_2016_Y21M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-228372r612748_rule, STIG-ID|EX16-MB-000190, STIG-Legacy|SV-95369, STIG-Legacy|V-80659, Vuln-ID|V-228372

Plugin: Windows

Control ID: 15e50798254ec20d2f629f7fd3c8a70ba97cdac4be2abfe6ee5237ebb975daa3