2.4.1 Ensure 'POP3' Windows services are 'Disabled'

Information

Post Office Protocol 3 (POP3) is an email protocol for receiving email messages from a server and transferring to a client device. On Exchange Server 2019 with the Mailbox role installed, it is set to manual startup by default.

Rationale:

POP3 is an outdated protocol that has a number of weaknesses versus MAPI and Exchange ActiveSync. POP3 can send credentials in the clear if not configured properly, has limited authentication capabilities, and a lack of proper message handling can result in misplaced or lost e-mails and folders when moving between devices. This may result in data loss for the end user. ActiveSync and MAPI, in contrast, offer superior security by default, provide an enhanced user experience, and are Microsoft's primary focus for support and improvement.

Impact:

Devices that require POP3 to function will be unable to receive e-mail from the Exchange Server. This should not be a problem for most client applications as Outlook 2013 and newer support modern authentication methods (OAuth) and protocols.

If an organization is required to use POP3 then care must be taken to only enable POP3, the PopEnabled parameter, for the mailbox in question.

Solution

To implement the recommended state, execute the following PowerShell commands:

Stop-Service MSExchangePop3,MSExchangePop3BE
Get-Service MSExchangePOP3,MSExchangePOP3BE | Set-Service -StartupType Disabled

Default Value:

StartType: Manual

See Also

https://workbench.cisecurity.org/benchmarks/12442

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7

Plugin: Windows

Control ID: 3b08ece461bca898df72fb16b03fb7e1e914e61194ab141760c77c372a4ea52c