The Exchange local machine policy must require signed scripts.

Scripts, especially those downloaded from untrusted locations, often provide a way for attackers to infiltrate a system. By setting machine policy to prevent unauthorized script executions, unanticipated system impacts can be avoided.

Open the Exchange Management Shell and enter the following command:

Get-ExecutionPolicy

If the value returned is not "RemoteSigned", this is a finding.

Open the Exchange Management Shell and enter the following command:

Set-ExecutionPolicy RemoteSigned