Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations Chriss Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Search results for query: *

  1. james3838

    Event ID 15001 when migrating mailboxes from 5.5

    Is there a contact with the same username?
  2. james3838

    Need help setting up an Ex2k3 test lab???

    Also take a look at http://www.microsoft.com/exchange/techinfo/interop/55.asp for some great upgrade scenario information. Ideally you will want to start out with an enviroment that represents what you have today, and then figure out the steps you need to go through to get to what you want...
  3. james3838

    PC keeps trying to authenticate

    Since its NTLM, its less likely to be a worm (should have picked up that before). Does he have any POP/IMAP accounts configured with either Outlook or Outlook express?
  4. james3838

    Exchange security hole

    You either have delegated rights or you are using an account that has rights to view that mailbox. It does not work like that when (default) permissions are set correctly.
  5. james3838

    OWA default directory?

    \\.\backofficestorage\<domain>\mbx
  6. james3838

    Delivery Server

    If you authenticated, then you are allowed to relay by default. That check box allows anonymous people to relay to that address space. If you created an address space of aol.com, then yes, 3rd parties can relay aol.com to your new server (not to AOL) as long as you specify a smarthost rather...
  7. james3838

    Delivery Server

    Its much easer then sendmail (unless you are using the access db)! :) Here's a basic configuration: Start Exchange System Manager (ESM) Right click on Connectors folder and select New SMTP Connector Set the name Change the delivery to smart host, and add the name or ip (use [] for IP's to skip...
  8. james3838

    Receive delay.

    The first step is to examine the recieved headers of a delayed message to figure out where the message was queued up. Once you have that information you can start figuring out exactally where to start looking.
  9. james3838

    RELAY?? But I fixed it already!..now what?

    Sbass2 - That is quite possible. But I've also seen people reporting non-guest/admin accounts being compromised that had strong passwords. Since W32.swen asks for this information, its the best target at this point, especially for the non-generic account compromise scenarios. Its also...
  10. james3838

    PC keeps trying to authenticate

    The machine is probably infected with W32.swen.a@mm worm. Check out http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.html for details
  11. james3838

    SMTP Queue filling up....FAST

    Based on my testing, 1707 events are what you get when you have failed logons. Too bad there is no information as to who they were trying to authenticate as. Exchange 5.5 has both success and failed events that are much easier to audit. BTW - Its very likely that one of your end users is...
  12. james3838

    RELAY?? But I fixed it already!..now what?

    I betcha this is the w32.swen.a@mm.html See http://www.sarc.com/avcenter/venc/data/w32.swen.a@mm.html for details. Check out step 12 for why I think its this virus. It is prompting infected users for authentication information.
  13. james3838

    RELAY?? But I fixed it already!..now what?

    If this indeed a Virus/Worm and your topology DOES NOT require end users to submit to your internet facing machines via SMTP, then I would highly recommend turning off authenticated relay! For those that have been hit by this (I have not), do you see lots of failed logon attempts? I would...
  14. james3838

    Exchange - Can't Receive Mail After IP Change

    Try using http://www.checkdns.net to verify that you have DNS configured correctly.
  15. james3838

    SMTP Queue filling up....FAST

    mmonti - that is the WRONG approach Someone has figured out the password to one of your accounts and is using it to authenticate. The correct solution is to figure out which account is compromised and either disable it or set a strong password on it. A compromised password can be used for...
  16. james3838

    RELAY?? But I fixed it already!..now what?

    KBADMIN - \administrator is the local machine administrator Unfortunately I don't have any NT4 boxes around anymore, so I can give you details on how to change the password/disable the local administrator account, but look on the box itself for a local Administrator account. Hopefully someone...
  17. james3838

    SMTP Queue filling up....FAST

    Check the Exchange 5.5 Forum for a detailed answer to your question. You most likely have an account that has a weak password that a spammer has figured out. They are able to relay because by default authenticated users are able to relay.
  18. james3838

    RELAY?? But I fixed it already!..now what?

    Exact steps for Exchange 5.5: Start->Programs->Microsoft Exchange->Microsoft Exchange Administrator Connect to your Org Find your internet facing server Select its properties (either select it and type <alt><enter> or hit the property button) Select the Diagnostics Logging Tab Select...
  19. james3838

    RELAY?? But I fixed it already!..now what?

    Turn your Diagnostic logging to Maximum for MSExchangeIMC -> SMTP Interface Events. Look at all SMTP Interface Events in the Event logs. Look for both 2010 Events (successful login) for accounts that SHOULD NOT BE AUTHENTICATING as well as 4183 Events (failed login). It appears that what ever...

Part and Inventory Search

Back
Top