RE: Exchange 2007 and Virtual Server

[Matteson, John H Jr USA Mr USA 25th SigBN (ITT)]

In other words, a "mis-advanture", eh? 


John H. Matteson, Jr.
Systems Administrator/ITT Systems
FOB Orgun-E
Afghanistan
DSN - 318 431 8001
VoSIP - (308) 431 - 
Iridium - 717.633.3823
Roshain - 079 - 736 - 3832

"A man who thinks of himself as belonging to a particular national group
in America has not yet become an American. And the man who goes among
you to trade upon your nationality is no worthy son to live under the
Stars and Stripes."  Woodrow Wilson


-Original Message-
From: Campbell, Rob [mailto:[EMAIL PROTECTED] 
Sent: Thursday, March 13, 2008 7:08 PM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2007 and Virtual Server

That's an "adventure" that's not going to be any fun. ;-) 

 

DAMHIKT 

 



From: Don Ely [mailto:[EMAIL PROTECTED]
Sent: Thursday, March 13, 2008 9:34 AM
To: MS-Exchange Admin Issues
Subject: Re: Exchange 2007 and Virtual Server

 

 



**
Note: 
The information contained in this message may be privileged and
confidential and protected from disclosure. If the reader of this
message is not the intended recipient, or an employee or agent
responsible for delivering this message to the intended recipient, you
are hereby notified that any dissemination, distribution or copying of
this communication is strictly prohibited. If you have received this
communication in error, please notify us immediately by replying to the
message and deleting it from your computer. 

**



 


~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

RE: Exchange 2007 SP1 Rollup 1

[Michael B. Smith]

Such as?

 

You'll get more improvement by installing the recommended memory fix-up
patches.

 

http://theessentialexchange.com/blogs/michael/archive/2007/12/24/patches-for
-your-holiday-maintenance-window.aspx

 

Regards,

 

Michael B. Smith

MCSE/Exchange MVP

http://TheEssentialExchange.com

 

From: Administrator [mailto:[EMAIL PROTECTED] 
Sent: Monday, March 17, 2008 8:54 AM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2007 SP1 Rollup 1

 

That was it.  Now it shows up.  How about the memory usage?  Any noticed
improvements since installing the Rollup?

 

Jonathan Jenkins

Jenkins Restorations, Inc.

www.jenkinsrestorations.com
 

 

From: Neil Hobson [mailto:[EMAIL PROTECTED] 
Sent: Monday, March 17, 2008 8:30 AM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2007 SP1 Rollup 1

 

Do you have "Show updates" ticked in Add/Remove programs?  Mine shows up.

 

From: Administrator [mailto:[EMAIL PROTECTED] 
Sent: 17 March 2008 12:17
To: MS-Exchange Admin Issues
Subject: Exchange 2007 SP1 Rollup 1

 

Does anyone know how to determine if the following Exchange 2007 Rollup has
already been installed on my Exchange box?  I am assuming it would have been
installed as a part of a Windows Update, but if I go to Add/Remove programs,
I don't see it listed.  Any advice would be appreciated.  Also, has anyone
installed this rollup and found that is fixes some of the memory issues that
have been discussed in this group with Exchange 2007?  

 

http://support.microsoft.com/kb/945684

 

 

Jonathan Jenkins

Jenkins Restorations, Inc.

www.jenkinsrestorations.com
 

 

 

 

 

 

 

 


~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

Re: Spammed to death

[Micheal Espinola Jr]

It would really be the best thing for him to do.

On Mon, Mar 17, 2008 at 3:18 PM, Steve Ens <[EMAIL PROTECTED]> wrote:

> Yes I've mentioned that to him...he doesn't seem to want to change his
> address though.  He's been here over 7 years and has many external
> contacts.  I've opened a ticket with Sunbelt and they're looking into it.
>
>
> On Mon, Mar 17, 2008 at 10:57 AM, Albert L <[EMAIL PROTECTED]> wrote:
>
> > How about just change his email address to something else? After that,
> > update your address list, and the anti-spam server should drop all of those
> > message for invalid receipt.
> >
> >
> > On Mon, Mar 17, 2008 at 6:21 AM, N Parr <[EMAIL PROTECTED]>
> > wrote:
> >
> > >  Properties of SMTP Virtual Server - Messages - Send copy of
> > > Non-Delivery Report to:  (assuming 2k3)
> > >
> > >  --
> > > *From:* Russ Clark [mailto:[EMAIL PROTECTED]
> > > *Sent:* Saturday, March 15, 2008 8:48 AM
> > > *To:* MS-Exchange Admin Issues
> > > *Subject:* RE: Spammed to death
> > >
> > >Could it be that this address is receiving every bounced email that
> > > your exchange server is processing (even bounced spoofed From address 
> > > emails
> > > are delivered here).  I have this setup with ESM on a separate account 
> > > just
> > > to keep it separate from other email, but that is what it sounds like when
> > > you say they are being delivered from system administrator.  I do not
> > > remember exactly where the setting is, but I'm sure someone else on this
> > > list knows.
> > >
> > >
> > >
> > > Russ Clark
> > >
> > >
> > >
> > > *From:* Steve Ens [mailto:[EMAIL PROTECTED]
> > > *Sent:* Friday, March 14, 2008 3:20 PM
> > > *To:* MS-Exchange Admin Issues
> > > *Subject:* Spammed to death
> > >
> > >
> > >
> > > I've got a user who gets thousands of messages each day from "system
> > > administrator" - Message could not be delivered.  I've come to the
> > > conclusion that someone has setup a spam server and used his email as the
> > > reply to address.  At first it was really funny, but now we are trying
> > > everything to block and filter these out.  We use Ninja and have him setup
> > > in his own policy.  The messages do not get a score however, and even with
> > > many custom rules I can't stop all the garbage going into his mailbox.
> > > Anything I can do in the exchange system manager apart from changing his
> > > smtp address?
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
>
>
>



-- 
ME2

~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

Re: Spammed to death

[Steve Ens]

Yes I've mentioned that to him...he doesn't seem to want to change his
address though.  He's been here over 7 years and has many external
contacts.  I've opened a ticket with Sunbelt and they're looking into it.

On Mon, Mar 17, 2008 at 10:57 AM, Albert L <[EMAIL PROTECTED]> wrote:

> How about just change his email address to something else? After that,
> update your address list, and the anti-spam server should drop all of those
> message for invalid receipt.
>
>
> On Mon, Mar 17, 2008 at 6:21 AM, N Parr <[EMAIL PROTECTED]> wrote:
>
> >  Properties of SMTP Virtual Server - Messages - Send copy of
> > Non-Delivery Report to:  (assuming 2k3)
> >
> >  --
> > *From:* Russ Clark [mailto:[EMAIL PROTECTED]
> > *Sent:* Saturday, March 15, 2008 8:48 AM
> > *To:* MS-Exchange Admin Issues
> > *Subject:* RE: Spammed to death
> >
> >Could it be that this address is receiving every bounced email that
> > your exchange server is processing (even bounced spoofed From address emails
> > are delivered here).  I have this setup with ESM on a separate account just
> > to keep it separate from other email, but that is what it sounds like when
> > you say they are being delivered from system administrator.  I do not
> > remember exactly where the setting is, but I'm sure someone else on this
> > list knows.
> >
> >
> >
> > Russ Clark
> >
> >
> >
> > *From:* Steve Ens [mailto:[EMAIL PROTECTED]
> > *Sent:* Friday, March 14, 2008 3:20 PM
> > *To:* MS-Exchange Admin Issues
> > *Subject:* Spammed to death
> >
> >
> >
> > I've got a user who gets thousands of messages each day from "system
> > administrator" - Message could not be delivered.  I've come to the
> > conclusion that someone has setup a spam server and used his email as the
> > reply to address.  At first it was really funny, but now we are trying
> > everything to block and filter these out.  We use Ninja and have him setup
> > in his own policy.  The messages do not get a score however, and even with
> > many custom rules I can't stop all the garbage going into his mailbox.
> > Anything I can do in the exchange system manager apart from changing his
> > smtp address?
> >
> >
> >
> >
> >
> >
> >
>
>
>

~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

RE: NDR setting to send only bounce message without the original message

[Carl Houseman]

Everyone who receives mail directly at their Exchange 2003 SMTP virtual
server should enable "filter recipients who are not in the directory" and
tarpitting.
 
Yes, it is effective at blocking NDR spam.   Of course if GFI is in front of
Exchange then you presumably have a similar setting within GFI, assuming GFI
can validate recipients within active directory.
 
Carl

  _  

From: Kyle Plummer [mailto:[EMAIL PROTECTED] 
Sent: Monday, March 17, 2008 2:16 PM
To: MS-Exchange Admin Issues
Subject: NDR setting to send only bounce message without the original
message



After extricating my domain from an RBL, the tech suggested I change a
setting on the mail server to only send the bounce message without the
original message. Is this the same as stripping attachments on an NDR? I'm
running Exchange 2003 fully patched. I've verified that I'm not an open
relay, and only my mail server can send SMTP messages from my network.

 

Is anyone doing Recipient filtering with tar pitting? Is it effective or a
pain? 

 

I'm using GFI Mail Essentials currently. Any other suggestions for blocking
spam, both internally and to prevent our domain from being used as an NDR
attack vector?

 

Thanks in advance,

 

Kyle B. Plummer

 


 


~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

RE: NDR setting to send only bounce message without the original message

[Kennedy, Jim]

Recipient validation up front, so you can 554 it during the SMTP phase. I don't 
recall exactly where it is at in 2003



From: Kyle Plummer [mailto:[EMAIL PROTECTED]
Sent: Monday, March 17, 2008 2:16 PM
To: MS-Exchange Admin Issues
Subject: NDR setting to send only bounce message without the original message

After extricating my domain from an RBL, the tech suggested I change a setting 
on the mail server to only send the bounce message without the original 
message. Is this the same as stripping attachments on an NDR? I'm running 
Exchange 2003 fully patched. I've verified that I'm not an open relay, and only 
my mail server can send SMTP messages from my network.

Is anyone doing Recipient filtering with tar pitting? Is it effective or a pain?

I'm using GFI Mail Essentials currently. Any other suggestions for blocking 
spam, both internally and to prevent our domain from being used as an NDR 
attack vector?

Thanks in advance,

Kyle B. Plummer





~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

NDR setting to send only bounce message without the original message

[Kyle Plummer]

After extricating my domain from an RBL, the tech suggested I change a
setting on the mail server to only send the bounce message without the
original message. Is this the same as stripping attachments on an NDR?
I'm running Exchange 2003 fully patched. I've verified that I'm not an
open relay, and only my mail server can send SMTP messages from my
network.

 

Is anyone doing Recipient filtering with tar pitting? Is it effective or
a pain? 

 

I'm using GFI Mail Essentials currently. Any other suggestions for
blocking spam, both internally and to prevent our domain from being used
as an NDR attack vector?

 

Thanks in advance,

 

Kyle B. Plummer

 


~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

Re: Spammed to death

[Albert L]

How about just change his email address to something else? After that,
update your address list, and the anti-spam server should drop all of those
message for invalid receipt.

On Mon, Mar 17, 2008 at 6:21 AM, N Parr <[EMAIL PROTECTED]> wrote:

>  Properties of SMTP Virtual Server - Messages - Send copy of Non-Delivery
> Report to:  (assuming 2k3)
>
>  --
> *From:* Russ Clark [mailto:[EMAIL PROTECTED]
> *Sent:* Saturday, March 15, 2008 8:48 AM
> *To:* MS-Exchange Admin Issues
> *Subject:* RE: Spammed to death
>
>Could it be that this address is receiving every bounced email that
> your exchange server is processing (even bounced spoofed From address emails
> are delivered here).  I have this setup with ESM on a separate account just
> to keep it separate from other email, but that is what it sounds like when
> you say they are being delivered from system administrator.  I do not
> remember exactly where the setting is, but I'm sure someone else on this
> list knows.
>
>
>
> Russ Clark
>
>
>
> *From:* Steve Ens [mailto:[EMAIL PROTECTED]
> *Sent:* Friday, March 14, 2008 3:20 PM
> *To:* MS-Exchange Admin Issues
> *Subject:* Spammed to death
>
>
>
> I've got a user who gets thousands of messages each day from "system
> administrator" - Message could not be delivered.  I've come to the
> conclusion that someone has setup a spam server and used his email as the
> reply to address.  At first it was really funny, but now we are trying
> everything to block and filter these out.  We use Ninja and have him setup
> in his own policy.  The messages do not get a score however, and even with
> many custom rules I can't stop all the garbage going into his mailbox.
> Anything I can do in the exchange system manager apart from changing his
> smtp address?
>
>
>
>
>
>
>

~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

RE: Spammed to death

[N Parr]

Properties of SMTP Virtual Server - Messages - Send copy of Non-Delivery
Report to:  (assuming 2k3)



From: Russ Clark [mailto:[EMAIL PROTECTED] 
Sent: Saturday, March 15, 2008 8:48 AM
To: MS-Exchange Admin Issues
Subject: RE: Spammed to death



Could it be that this address is receiving every bounced email that your
exchange server is processing (even bounced spoofed From address emails
are delivered here).  I have this setup with ESM on a separate account
just to keep it separate from other email, but that is what it sounds
like when you say they are being delivered from system administrator.  I
do not remember exactly where the setting is, but I'm sure someone else
on this list knows.

 

Russ Clark



 

From: Steve Ens [mailto:[EMAIL PROTECTED] 
Sent: Friday, March 14, 2008 3:20 PM
To: MS-Exchange Admin Issues
Subject: Spammed to death

 

I've got a user who gets thousands of messages each day from "system
administrator" - Message could not be delivered.  I've come to the
conclusion that someone has setup a spam server and used his email as
the reply to address.  At first it was really funny, but now we are
trying everything to block and filter these out.  We use Ninja and have
him setup in his own policy.  The messages do not get a score however,
and even with many custom rules I can't stop all the garbage going into
his mailbox.  Anything I can do in the exchange system manager apart
from changing his smtp address?

 


 


~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

RE: Exchange 2007 SP1 Rollup 1

[Administrator]

That was it.  Now it shows up.  How about the memory usage?  Any noticed 
improvements since installing the Rollup?

Jonathan Jenkins
Jenkins Restorations, Inc.
www.jenkinsrestorations.com

From: Neil Hobson [mailto:[EMAIL PROTECTED]
Sent: Monday, March 17, 2008 8:30 AM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2007 SP1 Rollup 1

Do you have "Show updates" ticked in Add/Remove programs?  Mine shows up.

From: Administrator [mailto:[EMAIL PROTECTED]
Sent: 17 March 2008 12:17
To: MS-Exchange Admin Issues
Subject: Exchange 2007 SP1 Rollup 1

Does anyone know how to determine if the following Exchange 2007 Rollup has 
already been installed on my Exchange box?  I am assuming it would have been 
installed as a part of a Windows Update, but if I go to Add/Remove programs, I 
don't see it listed.  Any advice would be appreciated.  Also, has anyone 
installed this rollup and found that is fixes some of the memory issues that 
have been discussed in this group with Exchange 2007?

http://support.microsoft.com/kb/945684


Jonathan Jenkins
Jenkins Restorations, Inc.
www.jenkinsrestorations.com








~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

RE: How to programmitically capture delivery failures.

[Campbell, Rob]

Thanks.  I'll keep that filed for future reference.

 

This particular project needs to have everything kept server-side, so
processing the NDRs through Outlook isn't going to be very practical.

 



From: Davies,Matt [mailto:[EMAIL PROTECTED] 
Sent: Sunday, March 16, 2008 3:43 PM
To: MS-Exchange Admin Issues
Subject: RE: How to programmitically capture delivery failures.

 

You could look at Genius Connect, it allows outlook to sync with a sql
database, we use it to keep our mailing lists up to date.

 

http://www.geniusconnect.com/geniusconnect.asp

 

Cheers

 

Matt

 

 

 

 

From: Campbell, Rob [mailto:[EMAIL PROTECTED] 
Sent: 14 March 2008 21:27
To: MS-Exchange Admin Issues
Subject: RE: How to programmitically capture delivery failures.

 

I'll look into them.  

 

I have to get anything that's not from an already approved vendor
through an approval and risk assessment process before I can install it
on a production machine.

 

Right now I'm just trying to get something reasonably reliable in place
and working as soon as possible.  Running them to the queue seemed like
the quickest way to be able to do that.  

 

I understand this is more of an "administrators solution" to the
problem, than a "developoer's solution", but for the moment I don't have
the luxury of getting to wear that hat for as long as it will take to do
it the "right" way.  

 



From: Michael B. Smith [mailto:[EMAIL PROTECTED] 
Sent: Friday, March 14, 2008 4:07 PM
To: MS-Exchange Admin Issues
Subject: RE: How to programmitically capture delivery failures.

 

I gotta go back and recommend the Lumisoft library. You can pull those
messages down using either POP-3 or IMAP and process them. The library
also has easy ways to deal with MIME encoding (which I've found
invaluable).

 

All that being said, the Exchange 2007 libraries for dealing with MIME
are well documented and slightly easier to use than Lumisoft's library.
However, by using the Lumisoft solution you can develop a solution NOW
that will work on both versions of Exchange Server.

 

ObDisclaimer: I am not associated with Lumisoft in any way. He fixed a
bug in his library for me once, and that's the only contact I've ever
had with the author. I've just had great luck with the solution -
especially when building applications in PowerShell and C#.

 

Regards,

 

Michael B. Smith

MCSE/Exchange MVP

http://TheEssentialExchange.com

 

From: Campbell, Rob [mailto:[EMAIL PROTECTED] 
Sent: Friday, March 14, 2008 8:19 AM
To: MS-Exchange Admin Issues
Subject: RE: How to programmitically capture delivery failures.

 

Well, I can pull the delivery failures out of the mailbox using the
\\.\backoffice   file path, but it's not pretty.
Using it also means I have to find another solution soon because I'm in
the process of getting rid of those E2K3 servers.

 

It seems like the hard part is getting them out of the mailbox.

 

I'm considering sending them to a dead-end queue, and pulling them out
of there as .eml files using the EMS export-message cmdlet.

 

As far as getting them to the queue, I was thinking of either sending
them from (or just re-directing the returns to) a non-authoritative
domain, setting up a send connector for that namespace, and dead-end it
(maybe smarthost it to an unreachable address).  All the returns should
collect in that connector's queue, and then it's just a matter of using
the EMS cmdlets to export them, and keep the queue cleaned up.  

 

Thoughts?

 



From: Michael B. Smith [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, March 11, 2008 7:56 PM
To: MS-Exchange Admin Issues
Subject: RE: How to programmitically capture delivery failures.

 

Actually, what you want is the M: drive.

 

I am one of the few that regret that that capability was removed from
Exchange 2007 (in Exchange 2003, it was available as
\\.\BackOfficeStorage\)

 

Regards,

 

Michael B. Smith

MCSE/Exchange MVP

http://TheEssentialExchange.com

 

From: Campbell, Rob [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, March 11, 2008 8:54 PM
To: MS-Exchange Admin Issues
Subject: RE: How to programmitically capture delivery failures.

 

Forget that idea.  I was thinking a journal report was stored outside of
a mailbox.  I'm no better off trying to get that than the original
email.

 

Seems like this ought to be easier.  I wish exmerge had an option to
export to .txt.

 



From: Campbell, Rob [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, March 11, 2008 7:48 PM
To: MS-Exchange Admin Issues
Subject: RE: How to programmitically capture delivery failures.

 

I was hoping you'd drop in.

 

I was just considering the possibility of setting up a mailbox to
receive the DSNs, journaling the mailbox and extracting the data out of
the journal reports.  

 



From: Michael B. Smith [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, March 11, 2008 

RE: Exchange 2007 SP1 Rollup 1

[Neil Hobson]

Do you have "Show updates" ticked in Add/Remove programs?  Mine shows up.

 

From: Administrator [mailto:[EMAIL PROTECTED] 
Sent: 17 March 2008 12:17
To: MS-Exchange Admin Issues
Subject: Exchange 2007 SP1 Rollup 1

 

Does anyone know how to determine if the following Exchange 2007 Rollup has
already been installed on my Exchange box?  I am assuming it would have been
installed as a part of a Windows Update, but if I go to Add/Remove programs,
I don't see it listed.  Any advice would be appreciated.  Also, has anyone
installed this rollup and found that is fixes some of the memory issues that
have been discussed in this group with Exchange 2007?  

 

http://support.microsoft.com/kb/945684

 

 

Jonathan Jenkins

Jenkins Restorations, Inc.

www.jenkinsrestorations.com
 

 

 

 


~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~

Exchange 2007 SP1 Rollup 1

[Administrator]

Does anyone know how to determine if the following Exchange 2007 Rollup has 
already been installed on my Exchange box?  I am assuming it would have been 
installed as a part of a Windows Update, but if I go to Add/Remove programs, I 
don't see it listed.  Any advice would be appreciated.  Also, has anyone 
installed this rollup and found that is fixes some of the memory issues that 
have been discussed in this group with Exchange 2007?

http://support.microsoft.com/kb/945684


Jonathan Jenkins
Jenkins Restorations, Inc.
www.jenkinsrestorations.com


~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~
~ http://www.sunbeltsoftware.com/Ninja~