Ensure the SharePoint Central Administration site is not accessible from Extranet or Internet connections

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Determine the Central Administration port (stsadm -o getadminport from %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\16\BIN, or Get-SPWebApplication -IncludeCentralAdministration). Verify in the firewall rules that this server/port is not reachable from the Internet, extranet or other external connections.

How it is fixed

Fix method: Guidance or infrastructure patch

Configure perimeter and host firewalls so the Central Administration port is reachable only from internal administrative networks.