Automatically configure user profile based on Active Directory primary SMTP address must be enforced.

From Microsoft Outlook 2010 STIG

Part of DTOO278 - Auto configure profile based on AD

Associated with: CCI-000366

SV-33487r2_rule Automatically configure user profile based on Active Directory primary SMTP address must be enforced.

Vulnerability discussion

If a user is joined to a domain in an Active Directory environment and does not have an e-mail account configured, Outlook populates the e-mail address field of the New Account Wizard with the primary SMTP address of the user who is currently logged on to Active Directory. The user can change the address to configure a different account, or click Next to use the default settings from Active Directory. If users are allowed to change this address, they could incorrectly configure their environment or misrepresent their identity.

Check content

NOTE: If Outlook 2010 is configured to access DoD Enterprise Email, this check is not applicable. The policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2010 -> Account Settings -> Exchange “Automatically configure profile based on Active Directory Primary SMTP address” must be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\14.0\outlook\autodiscover Criteria: If the value ZeroConfigExchange is REG_DWORD = 1, this is not a finding.

Fix text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2010 -> Account Settings -> Exchange “Automatically configure profile based on Active Directory Primary SMTP address” to “Enabled”.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.