Exchange message tracking logging must be enabled.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-259657 | SRG-APP-000098 | EX19-MB-000041 | SV-259657r960900_rule | 2025-05-14 | 2 |
Description
A message tracking log provides a detailed log of all message activity as messages are transferred to and from a computer running Exchange.
If events are not recorded, it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users.
ℹ️ Check
Open the Exchange Management Shell and enter the following command:
Get-TransportService | Select-Object -Property Name, MessageTrackingLogEnabled
If the value of MessageTrackingLogEnabled is not set to True, this is a finding.
✔️ Fix
Open the Exchange Management Shell and enter the following command:
Set-TransportService <IdentityName> -MessageTrackingLogEnabled $true
Note: The <IdentityName> value must be in quotes.