Rule ID
SV-259695r1015277_rule
Version
V2R3
Antimalware protection in Exchange Server 2019 helps combat viruses and spyware in an email messaging environment. Viruses infect other programs and data, and they spread throughout computer looking for programs to infect. Spyware gathers personal information (for example, sign-in information and personal data) and sends it back to its author. The antimalware protection in Exchange Server was introduced in Exchange 2013 and is provided by the Transport agent named Malware Agent. The agent scans messages as they travel through the Transport service on a Mailbox server. To ensure increased effectiveness of the Malware Agent, ensuring its signatures are automatically updated is imperative. Not doing so can lead to system compromise. The Malware agent is installed during the initial installation of Microsoft Exchange server and if installed, is set for automatic updates by default.
In Exchange Management shell, run the following cmdlet: Get-MalwareFilteringServer |Select-Object -Property Name, *Update* If the property "Update frequency" is not set, this is a finding. If the Malware agent is not installed, then this is not applicable.
In an elevated Exchange management shell, run the following cmdlet: Set-MalwareFilteringServer -Identity <Identity> -UpdateFrequency <integer> Where <Identity> is the name of the Exchange Server and <integer> is the update frequency (in minutes). Refer to the Enterprise Domain Security Plan (EDSP) for the update cadence that best aligns with the user's organization.