Controls/EDCA-SEC-036.json

{
  "id": "EDCA-SEC-036",
  "title": "Exchange email application does not share a partition with another application",
  "description": "The Exchange email application MUST NOT share a partition with another application. Installing Exchange on a volume that also hosts other server applications creates resource contention and increases the risk that another application's failure will impact Exchange availability. Exchange binaries must reside on a dedicated partition.",
  "verify": true,
  "subject": "Server",
  "category": "Platform Security",
  "severity": "Medium",
  "severityWeight": 5,
  "frameworks": [
    "DISA"
  ],
  "references": [
    {
      "name": "DISA STIG EX19-MB-000229: The Exchange email application must not share a partition with another application (V-259704)",
      "url": "https://www.stigviewer.com/stigs/microsoft_exchange_2019_mailbox_server/2025-05-14/finding/V-259704"
    },
    {
      "name": "Exchange Server deployment best practices",
      "url": "https://learn.microsoft.com/exchange/plan-and-deploy/deployment-ref/preferred-architecture"
    }
  ],
  "remediation": {
    "automatable": false,
    "description": "Ensure Exchange is installed on a volume not shared with other application binaries. Review installed applications on Exchange servers.",
    "scriptTemplate": "# Diagnose: Identify the Exchange install drive and list top-level directories not part of Exchange or Windows.\n$exchDrive = Split-Path $exinstall -Qualifier\nGet-ChildItem $exchDrive -Directory -ErrorAction SilentlyContinue |\n Where-Object { $_.Name -notin @('Exchange', 'ExchangeSetupLogs', 'Program Files', 'Program Files (x86)', 'Windows', 'Users', 'PerfLogs', 'inetpub') } |\n Select-Object FullName\n# Unexpected directories on the Exchange volume may indicate other applications are co-located."
  },
  "considerations": "Migrating Exchange to a different volume is a complex operation that may require reinstallation. In many environments this is a planning concern addressed at deployment time. Document deviations with a risk acceptance if remediation is not feasible.",
  "roles": [
    "Mailbox",
    "Edge"
  ]
}